Varun Iyer
Hi, I'm Varun. I'm an independent AI safety researcher working on interpretability, reinforcement learning, and inference. Lately I've been studying how safety monitors built on model internals hold up as models keep training, and what it costs to run them on real inference servers.
I've co-founded three startups: Soma (a decentralized network that trains specialist models for distillation), Glass (decentralized video, $1M+ to creators), and Spott (map-based social network). Earlier, neuroscience-inspired AI and a math REU on search engine algorithms at UChicago.
Recent writing
-
A J-space Monitor Survives the Training That Breaks Probes
A Jacobian lens fitted once on a base model detects trained-in reward hacking, removes part of it, and survives 250 steps of RL pressure without refitting. Hacking that RL grows by itself never shows up at all.
-
A Fused Probe-Scoring Kernel: Triton vs CUDA vs cuBLAS
I fused a safety probe's activation gather and scoring into one GPU kernel, in Triton and in hand-written CUDA. At decode sizes everything ties, at large batches fusion wins 4.7x, and with many probes cuBLAS beats both hand-rolled kernels.
-
Running Safety Probes on Production Inference Servers
Reading activations for a safety probe the standard way slows decoding by up to 194%. A kernel that lives inside the CUDA graph makes it free on both vLLM and SGLang, and prefix caching turns out to hide most of the tokens a monitor would want to read.
-
Testing Computer-Use Agents on Real Accounting Work
I built cua-bench, a benchmark that has computer-use agents do accounting in a real ERP system and grades the final ledger state. Results from 854 rollouts across four frontier models, and how the grader resists reward hacking.
-
A Probe That Detects Can Still Fail to Silence
A linear probe can detect a behavior and steer it, and still fail to remove the behavior when you project its direction out. The standard checks cannot see that failure.