I work on the performance and numerical correctness of scientific and ML software. Most of my open-source work is algorithmic speedups and correctness fixes in libraries that other people build on: Google JAX, statsmodels, xarray, fsspec, Bokeh, Hugging Face candle, Apple MLX, the Rust cc crate, Mozilla sccache, Apache ShenYu, ONNX, Prometheus, the WordPress block editor (Gutenberg), and software run by US government agencies and national laboratories: CISA, NIST, USGS, Sandia National Laboratories and Idaho National Laboratory.
M.S. in Computer Science, University of Cincinnati. AI Engineer at Zasti Inc. (Ashburn, VA).
flowchart TB
me(("Bhaskar Gurram")):::me
me --> jax1
me --> jax2
me --> cc
subgraph perf["Performance"]
jax1["JAX: batched lexsort / unique"]:::node
sm["statsmodels: closed-form LOO influence"]:::node
xr["xarray: interp skips redundant sort"]:::node
candle["candle: tiled CPU quantized matmul"]:::node
jax1 ~~~ sm ~~~ xr ~~~ candle
end
subgraph corr["Numerical correctness"]
jax2["JAX: zeta JVP, pareto support"]:::node
mlx["MLX: left-padding mask in batched generation"]:::node
onnx["ONNX: DynamicQuantizeLinear all-zero scale"]:::node
pygsti["pyGSTi: default POVM on sub-models"]:::node
pylint["pylint: pyreverse recursion hang"]:::node
bokeh["Bokeh: nested layouts"]:::node
moose["INL MOOSE: SchemaDiff negative lists"]:::node
jax2 ~~~ mlx ~~~ onnx ~~~ pygsti ~~~ pylint ~~~ bokeh ~~~ moose
end
subgraph sec["Security and reliability"]
cc["Rust cc: PGO flags no longer leak to C"]:::node
shenyu["Apache ShenYu: no HTML rendering of responses"]:::node
cset["CISA CSET: PBKDF2 work factor"]:::node
usgs["USGS: open-ended date ranges"]:::node
ls["LangSmith: keep HTTP response on errors"]:::node
pym["pymilvus: import keeps app log handlers"]:::node
nist["NIST mSCP: CLI help"]:::node
prom["Prometheus: exact /metrics route"]:::node
cc ~~~ shenyu ~~~ cset ~~~ usgs ~~~ ls ~~~ pym ~~~ nist ~~~ prom
end
classDef me fill:#2a78d6,stroke:#1f4e9c,color:#ffffff,font-weight:bold
classDef node fill:#f5f7fb,stroke:#9fbce6,color:#0b1b3a
style perf fill:#eaf1fb,stroke:#2a78d6,color:#0b1b3a
style corr fill:#eaf1fb,stroke:#2a78d6,color:#0b1b3a
style sec fill:#eaf1fb,stroke:#2a78d6,color:#0b1b3a
Each bar is a change that was reviewed and merged by the project's maintainers. Timings are from the pull requests.
| Project | Contribution | Result |
|---|---|---|
| Google JAX | Batched lexsort / unique(axis=...): new batch_size keyword, designed with a core maintainer over six review rounds |
Compile time no longer grows with the number of keys: jnp.unique 15.5 s → 0.28 s; lexsort on 100 keys 162 s → 0.22 s |
| statsmodels | Closed-form leave-one-out influence measures (dfbetas, dffits, cov_ratio, studentized residuals); closes maintainer issue #9009 |
35 s → 2.7 ms at n = 10,000; matches R's influence.measures to 12 decimals |
| xarray | interp skips sortby on already-sorted coordinates |
Vectorized interp 164 ms → 2.9 ms |
| Hugging Face candle | Row tiling in the CPU quantized matmul for prefill | About 1.45x faster prefill for Q4K / Q8_0; outputs bit-identical |
Rust cc crate (rust-lang/cc-rs) |
Stop forwarding -Cprofile-generate/-Cprofile-use to the C compiler; fixes #1986 |
PGO builds no longer segfault when the C compiler's LLVM differs from rustc's (the cause behind rust-lang/rust#163640); shipped in cc 1.8.0 the same day |
Rust cc crate (rust-lang/cc-rs) |
Keep the order of flag and flag_if_supported; fixes #855 |
Probed flags were always emitted after plain flags, so a later flag could not override them; both now share one ordered list (open since 2023) |
| Mozilla sccache | Handle MSVC /Tc and /Tp input arguments; fixes #2062 |
Windows Rust builds using sccache broke once cc 1.5 started passing -Tp <file>; projects such as rattler-build pinned cc 1.4.7 to work around it |
| cargo-binstall | --dns option to pick the DNS resolver |
Users behind VPNs or NSS-only containers can switch from the built-in hickory-dns to the system resolver |
| fsspec (filesystem layer under pandas, xarray, Dask, Hugging Face) | callback= for download progress on caching filesystems; closes #1623 |
Progress reporting for multi-GB cached downloads, requested by NVIDIA's earth2studio team; merged by the lead maintainer |
| deepset Haystack | Remove the unused Sockets.__getattribute__ override |
The override looked up the wrong attribute name and was never reached; removed with type-checked tests after three review rounds |
| Bokeh | Nested layouts more than two levels deep (closes #13384, #14359, milestone 4.0); Row/Column layout reserves room for aligned borders (BokehJS) | Fixes cropped axes and legends; milestone 4.0, backported |
| Apple MLX (mlx-lm) | Left-padding mask in batched generation | Fixes wrong logits for left-padded batches in two model families |
| Google JAX | New jax.scipy.special.gammaincinv and gammainccinv; closes #5350 (open since 2021) |
Differentiable inverse incomplete gamma (the gamma quantile), so JAX users no longer need TensorFlow Probability for it; designed over three review rounds with a core maintainer and tested against mpmath |
| Google JAX | betainc converges per element; fixes #28547 |
The continued fraction no longer runs to the 200/600-iteration cap for the whole batch (24/43 iterations on the issue's input), and each result no longer depends on the rest of the batch |
| Google JAX | zeta JVP rule, pareto support boundary |
Correct values and gradients outside the domain and at the support edge |
| ONNX (Linux Foundation AI) | Define DynamicQuantizeLinear scale for all-zero inputs |
Spec and reference fix: all-zero inputs no longer give a zero scale (NaN downstream); now matches ONNX Runtime |
| Apache ShenYu (Apache Software Foundation) | Render non-JSON API debug responses as plain text; fixes security issue #614 | The admin console no longer renders upstream response bodies as HTML; merged by a ShenYu PMC member |
| Apache ShenYu (Apache Software Foundation) | Parse plugin-handle check rules without eval; fixes security issue #613 |
Admin-stored rule strings are no longer executed as JavaScript in the admin console; merged by a ShenYu PMC member |
| pylint | Fix pyreverse hang/RecursionError with --all-associated; closes #3602 |
Class diagrams of code that rebuilds classes on each inference no longer hang or crash; merged by the pylint maintainer and backported to 4.1.x |
| CISA CSET (US DHS) | Raise the PBKDF2 work factor to OWASP guidance | Password-hash hardening in CISA's Cyber Security Evaluation Tool |
| NIST macOS Security Compliance Project (US Dept. of Commerce) | Show full help for --help and subcommand --help; fixes #838 |
The mscp CLI's subcommand help was swallowed by the logging-flag parser; now each subcommand prints its real options |
| MOOSE (Idaho National Laboratory, US DOE) | Fix SchemaDiff string lists with negative values; fixes #33873 | MOOSE's regression-test differ misread lists containing negative numbers; used by every MOOSE app's test suite, including INL's Griffin reactor-physics code |
| Prometheus client_python (CNCF) | Allow make_asgi_app to be added as a Starlette/FastAPI route; fixes #1016 | app.add_route("/metrics", make_asgi_app()) now serves the exact path instead of redirecting to /metrics/; Starlette added to CI so both routes are tested. Approved by two maintainers. |
| gcsfs (Google Cloud Storage for fsspec) | Sign URLs through the IAM signBlob API when credentials have no private key; fixes #653 | GCSFileSystem.sign() now works on Compute Engine and GKE Workload Identity, where credentials carry no private key, by signing through IAM signBlob with the service account's token. Reviewed over two rounds by Google maintainers and merged. |
| WordPress Gutenberg (the WordPress block editor) | Keep snackbars with an action on screen longer; closes #53200 | Notices with an action such as "View Post" now stay 10 seconds instead of 6, so people using a pointer or the keyboard can reach the action before it disappears. Approved and merged by a Gutenberg components maintainer for Gutenberg 24.3. |
| tower-http (Rust HTTP middleware under axum and tonic) | Add validate() and CorsConfigurationError to the CORS layer; fixes #272 |
Applications can check a CORS configuration up front and report an error instead of panicking later when credentials are combined with a wildcard. Reviewed and merged by a tower-http maintainer. |
| SAM simulation core (National Laboratory of the Rockies, formerly NREL, US DOE) | Don't pay out net-metering dollar credits that roll over; fixes SAM#2264 | With rollover on, the December true-up paid out the banked credit and also carried it forward, so savings compounded year after year; the payout is now skipped when credits roll over. Approved and merged by the SAM maintainer for the SAM 2026 patch release. |
| solar (Paradigm's Solidity compiler in Rust) | Drop the macOS PGO C flag workaround | solar carried a CFLAGS workaround because the cc crate leaked rustc's profiling flags into C compiles. My cc-rs fix (released in cc 1.8.0) removed the cause, so solar adopted it and dropped the workaround. Approved and merged by a solar maintainer. |
| ureq (the most-used blocking HTTP client for Rust) | Add Agent::shutdown() for active and pooled connections; closes #641 |
A blocking request could not be stopped from another thread, so programs hung at exit or past worker deadlines. Agent::shutdown() now interrupts in-flight requests, including TLS, SOCKS and CONNECT handshakes, through a shutdown registry in the connection pool. Designed with and approved by ureq's author after three review rounds. |
| socket2 (Rust project; the socket crate under tokio, mio and hyper) | Add exclusive_address / set_exclusive_address; closes #676 |
Windows SO_EXCLUSIVEADDRUSE support, so a socket can't be hijacked by another process that binds the same port with SO_REUSEADDR. Approved and merged by the tokio/mio maintainer. |
| USGS dataretrieval (US DOI) | Open-ended (..) date ranges in the OGC client, date/datetime/Timestamp arguments, start/end interval strings |
Fixes silently unfiltered results and HTTP 400s in the official USGS water-data client |
| Sandia National Laboratories pyGSTi | Default POVM for circuits on a subset of a model's qubits; fixes #721, a 0.11 release blocker | Circuits on part of a multi-qubit model no longer fail with "Missing POVM"; merged by a Sandia maintainer |
| Microsoft Olive | Declare requests as an install dependency |
Fixes import olive failing after a fresh install; also hit by Microsoft's olive-recipes |
| LangSmith SDK | Keep the HTTP response on raise_for_status_with_text errors |
Shipped in v0.14.2 |
| Milvus pymilvus (LF AI & Data) | Stop closing application logging handlers on import and stop bulk_writer from configuring the root logger; fixes #3794 | Importing the SDK no longer silently kills or reconfigures the host application's logging; both backported to 2.6 and 3.0 |
| ogx | Dependency floor for the inline provider | Fixes a user-reported install failure |
| cartography (CNCF) | Handle empty Google Workspace groups | Fixes a sync crash |
In review right now (75+ open pull requests)
Features and fixes under maintainer review as of October 2026, among them:
- Apache Arrow (arrow-rs): check Parquet bloom filters against Arrow arrays (
ArrowSbbf), closes #5550 - gcsfs (Google Cloud Storage for fsspec): generation pinning at
open() - Lawrence Livermore National Laboratory, Conduit: strided structured topologies in
to_unstructured, keep domain ids insave_mesh - National Renewable Energy Laboratory, SAM simulation core: lifetime fuel usage for custom generation
- Sandia National Laboratories pyGSTi: full-TP POVM conversion; NIST teqp: Gross-Vrabec polar terms at zero composition
- Open Data Cube (Geoscience Australia): refreshable AWS credentials for GDAL
- anchore/grype:
--fail-on risk=Nthresholds and--fail-on no-vex-statement; anchore/syft: Maven scope exclusion - mermaid: flowchart
linkStyleselecting links by label text; plotly.py:custom_dataforpx.histogram; rust-lang/socket2:SO_EXCLUSIVEADDRUSE - plus pandas, PyTorch, Apache DataFusion, statsmodels, xgboost, hickory-dns, Sphinx, gitleaks, git-lfs, modin, tower-http, resvg and others
- Valid Per-Field Selective Risk Control for Document Extraction: Three Failure Modes, a Validity Ladder, and When Conditioning Pays. B. Gurram. arXiv:2608.14639, 2026. Code: verifydoc.
- Auditing Automated Evaluation, Error Propagation, and Runtime Mitigation in Tool-Using Language Agents. B. Gurram. arXiv:2604.16706, 2026. Code: agenthallu-bench.
- Agentic systematic literature review: a multi-agent LLM pipeline evaluated on 62 randomized controlled trials across five medical specialties. Submitted to Expert Systems with Applications, 2026. Code: agentic-slr.
- M.S. thesis (2024): EEG-fMRI fusion with temporal convolutional networks for decoding visual stimuli. Accuracy is 84.8% within subject and 81.1% leave-one-subject-out, compared with 65.5% for EEG only and 74.6% for fMRI only. Advisor: Prof. Vikram Ravindra.
- verifydoc: calibrated per-field confidence and source grounding for document-to-JSON extraction, with accept/review abstention.
- unwind: a reversibility layer for agent tool calls. It is an MCP proxy with a cross-server undo log.
- provio: authorization and provenance for AI agent tool calls.
- HARNESS-DB: a coded dataset of 1,256 agent harnesses.
Numerics and ML: JAX, NumPy/SciPy, PyTorch, statsmodels, xarray, quantized inference (candle, MLX, GPTQ). Systems: Rust, Go, Python packaging, CI. Agents: MCP, retrieval, evaluation harnesses.
- AI Engineer, Zasti Inc. (2024–present): agentic and retrieval systems for clinical research. Retrieval over 50M+ document embeddings, and 4-bit GPTQ deployment that cut model size by 75%.
- Graduate Teaching Assistant, University of Cincinnati (2022–2024): Python, cloud and ML labs for 500+ students.
- Deep Learning Developer, Technocolabs Softwares (2021–2022): led a four-person team building medical pattern-recognition models.
- M.S. Computer Science, University of Cincinnati, 2024. GPA 3.95/4.0. Graduate Incentive Award.
- B.Tech. Computer Science, SRM Institute of Science and Technology, 2022. GPA 3.98/4.0.
- MicroMasters in Data Science, UC San Diego, 2022.