Carl Lochstampfor - Cybersecurity & AI Security Researcher

e-Resume v2.17.3

Executive Summary

Cybersecurity undergraduate at Old Dominion University (3.9 GPA) with CompTIA Security+, Network+, and A+ certifications. AI security researcher with two arXiv preprints on synthetic fraud detection (COVA and COVA-X, both in the peer-review process), an independent evaluation of a commercial AI safety API (Tuteliq, 2026), and a live dataset platform (ScamLingua.org). Background includes over a decade in high-risk, regulated financial environments (FNMA, FHLMC, FHA, VA), applying the same rigor to incident response, system hardening, and AI governance. Proven record of managing 3× standard workloads while sustaining 95%+ accuracy.

🎯 Actively seeking a cybersecurity internship Open to AI security, ML engineering, and applied research roles full-time upon graduation.

Synthetic Conversations

Model Accuracy

Fraud Categories

arXiv Preprints

🔬 Featured Research

COVA & COVA-X mentored by Dr. Ayan Roy (Christopher Newport University) • CCI Undergraduate Research Program

🧪

Tuteliq Phase 1: Independent Evaluation of a Commercial AI Safety API

Published

Lead Evaluator | Sep–Oct 2026

Designed and ran an independent, unpaid black-box evaluation of Tuteliq's text-safety detection API across five harm categories, on 1,344 synthetic test cases generated locally with Gemma 3 12B. Froze and fingerprinted every dataset, scored results offline with 95% Wilson intervals, and validated labels through a blind second-evaluator check (82% agreement, Cohen's kappa 0.64). Reported strengths and clear weaknesses (social engineering: 83.7% detected, 13.2% false alarms). Authored a 36-page full report and a public summary, both published with Tuteliq's permission.

Gemma 3 12B Black-Box Testing 5 Harm Categories Wilson Intervals Cohen's Kappa 1,344 Cases

Synthetic, English-language text only; not a certification or audit.

▶ Technical Details

🔬 Evaluation Scope

Five harm categories.
1,344 test cases: 1,294 conversations + 50 single messages.
Second evaluator: Dr. Ayan Roy (Christopher Newport University).

📊 Results

Romance scams: 100% (130/130) detected, 6.9% false alarms
Coercive control: 99.2% detected, 0.8% false alarms
Self-harm and emotional distress: 96.1% detected, 0.8% false alarms
Bullying: 84.5% detected, 4.6% false alarms
Social engineering: 83.7% detected, 13.2% false alarms

Weakest areas: government-pretext identity scams (7 of 28 detected) and bullying that builds gradually from teasing (65.2%). Synthetic, English-language text; detector tuteliq-detect-v5.20261015, tested October 19, 2026.

📎 Reports

📄

COVA Framework

Preprint

Multi-agent LLM framework for generating labeled synthetic scam conversations targeting elder populations. Established baseline classification using XGBoost + TF-IDF achieving 72.5% accuracy across 8 elder-fraud categories.

Multi-Agent LLM Qwen 2.5 14B Ollama scikit-learn XGBoost TF-IDF 3,201 Samples

arXiv: 2604.11752 • Peer review in progress

▶ Technical Details

🛠️ Tools & Frameworks

Python scikit-learn XGBoost Hugging Face PyTorch DistilBERT Longformer Ollama Qwen 2.5 14B

🔬 Methodology Highlights

Two independent LLM agents (attacker + victim) exchange turns iteratively, producing natural resistance and escalation dynamics across 8 elder-fraud categories and 16 prompt templates.
Parameterized victim personas (age 65–85) with trust, scam-awareness, and tech-savviness traits; attacker knowledge tiers (cold-call 50% / partial 30% / full 20%).
Initially prototyped with commercial LLM APIs (including Anthropic Claude); transitioned to local Qwen 2.5 14B inference via Ollama on NVIDIA RTX 4080 Super (16 GB VRAM) after safety guardrails blocked scam role-play scenarios — enabling unrestricted generation, zero API cost, and full data privacy.
Built a negation-aware v2 label-audit pipeline after discovering a 49.8% initial mismatch, relabeling 1,594 conversations for outcome-label integrity.

📊 Notable Results

Benchmarked 8 models (6 classical ML + 2 transformers); XGBoost + TF-IDF led at 72.5% accuracy / 0.691 macro-F1.
TF-IDF lexical features beat 28 hand-engineered features by 16 points — quantifying how much discriminative signal lives in the raw text.
Isolated input truncation and limited data scale as the transformer bottleneck — a hypothesis directly tested (and confirmed) in COVA-X.

🏗️ Pipeline Architecture

End-to-end pipeline: prompts → local LLM → multi-agent dialogue → quality checks → labeled dataset

🖼️ Pipeline in Action

Terminal output showing the COVA generation pipeline completing 10 bank scam conversations via Qwen 2.5 14B in 8 minutes 50 seconds

Generating 10 bank conversations via Qwen 2.5 14B (8m 50s)

Sample generated bank scam conversation (turns 0-5) in which a skeptical victim persona resists the attacker's social engineering

Sample output: skeptical victim resists social engineering

Live pipeline screenshots: generation → sample dialogue

👤 My Contributions

Lead author. I designed and implemented the multi-agent generation pipeline that produces realistic attacker-victim dialogue exchanges. I engineered the 28-feature extraction system and TF-IDF representation, built the v2 label-audit tooling that corrected 1,594 mislabeled conversations, and trained and evaluated all eight baseline classifiers.

📎 View on arXiv

📄

COVA-X Benchmark

Preprint

Expanded benchmark with 10,985 synthetic conversations. Fine-tuned Longformer achieving 79.71% accuracy and 0.779 macro-F1, advancing the state of elder-fraud detection research.

Longformer Hugging Face PyTorch Ollama Qwen 2.5 14B 10,985 Samples

arXiv: 2606.06879 • Peer review in progress

▶ Technical Details