End-of-year projects

Contents

• What these projects are for
• Common rules
• Year 1 projects (end of Period 2)
  • Y1.1 GraphRAG with a learned retrieval router
  • Y1.2 Demand-aware fleet dispatch
  • Y1.3 Cold-start news recommendation
  • Y1.4 Molecules from words
  • Y1.5 Scene-graph question answering under noise
• Year 2 projects (Transverse project)
  • Y2.1 Semi-structured biomedical QA
  • Y2.2 A text-to-3D-molecule copilot
  • Y2.3 Speak, see, shop
  • Y2.4 The natural-language dispatcher
  • Y2.5 Fraud alerts you can defend
• Objectives and courses at a glance
• Every course’s own projects

What these projects are for

These notes are independent study notes. Every project on this page is a proposal, not an official subject: the programme publishes no Year 1 project subject, and the Transverse project leaves brief and grading to the official project setup.

The aim is to make the courses work together on one real question at the end of each year, the way a research internship or a job will. Each brief names the official vehicle it can serve, the course chapters it relies on and the master objectives it exercises.

Year 1: the Period 2 project vehicles

Every Year 1 project combines the three mandatory Period 2 courses (Reinforcement Learning, Graph ML, Text Mining & NLP) with the Period 1 foundations (Machine Learning, one Deep Learning course, the refreshers) and at least one elective. It is a dress rehearsal for the 16-week Research-oriented internship.

Period 2 already holds three project slots, none of them with a subject:

• Graph ML team project. The course description announces “quizzes and team projects”. In the session plan of these notes, session 9 is “lab: Example 8.1 (start the team project)”.
• RL course project (50 %). The course description announces a course project (50 %) and practical work (50 %). The closest material is Ex. 18, “Agent project”.
• NLP capstone. Ex. 14 is a capstone pipeline that exports its triples to the Graph ML mini-GraphRAG.

The proposal: one team repository, three graded components. The graph work package is graded as the Graph ML team project, the RL work package as the RL course project, and the NLP work package as the NLP capstone.

Timeline: six weeks, from Graph ML session 9 (W1) to about two weeks after the end of Period 2. Period 2 runs from 4 January to 19 March 2027 on the course sheets; the exact weeks depend on the official timetable. The project ends before the research internship starts.

Assumed workload: 60–80 h per student in a group of 3 to 5, and 45–60 h for a solo variant.

Year 2: the Transverse project

Every Year 2 project combines the two Year 2 core courses (Large Language Models and Analysis and Deep Learning on Geometric Data) with at least two Year 2 advanced themes and the Year 1 foundations.

The vehicle is the official Transverse project (8 ECTS, mandatory). At the usual 25–30 h per ECTS, that is about 200–240 h of student work; the programme publishes no split.

Proposed shape: a charter week (W0) at the end of Year 2 Period 1, a six-week build phase (W1–W6) in Period 2, then the defence. Every Year 2 project also feeds the Ethics seminar (one case memo) and the Final internship (one open question).

The ten projects

Each year serves both routes of the home page: two Graph × LLM projects, two AI-systems projects and one for both. The industry cases cover healthcare, molecules, recommendation, logistics and finance.

Objectives O1–O8

The objective ids follow the official description quoted on the home page.

The projects push hardest where the mandatory path is thinnest:

• O5, which no course takes to full depth;
• O6, whose generative part barely appears on the mandatory path;
• O8, which the mandatory path covers narrowly;
• O7, because the project vehicles have no subject and logistics appears in no course.

Common rules

These rules apply to every project. Each brief adapts them to its own question.

Charter

A two-page charter is due at the end of W1 in Year 1 and at W0 in Year 2. A tutor reviews it, and it is re-read against the final report. It fixes six things.

1. One question, one metric, one baseline per work package, before any stacking of models: the rule of the research-internship page.
2. “Done” in usage terms, as the Transverse project page asks: an acceptance test stated as what a user can do, not only as a model metric. Mandatory in Year 2, encouraged in Year 1.
3. Module map: for each work package, the 2–3 course chapters it applies, as the final-internship page asks. The internship report reuses this “path evidence”.
4. Compute and cost budget in FLOPs, GPU-hours and euros, with the calculators of Deep Learning (P2) ch. 1 and ch. 6 (Ex. 7) or Emerging ML ch. 7. Year 2 adds the euros-per-million-tokens model of MLOps ch. 4.
5. Data licence and consent: the licence of each dataset (several below are non-commercial), and consent forms whenever people are recorded or rate outputs.
6. Courses actually taken. Several Year 2 courses are “slot TBC” and the Year 2 Period 2 list is unpublished. Each brief names a fallback chapter for every slot-TBC course it uses.

Shared evaluation kit

Every team builds or reuses the same evaluation kit. Its pieces already exist in the notes, scattered across courses:

• leak-free pipelines and the “golden rule” of Machine Learning ch. 4: 4.2 nested CV, 4.3 leaks, 4.5 calibration, 4.6 reference pipeline;
• leakage-free graph splits and temporal splits: Graph ML Example 8.1 and the causality rule of Graph ML 5.6–5.8;
• paired comparisons with confidence intervals: the “Graph × LLM transfer check” of the statistics refresher’s exit checkpoint (paired gains, cluster bootstrap by source group, shuffled-edge control) and its ch. 6 (tests; 6.6 multiple testing);
• the winner’s curse when the best of many runs is picked (Example 3.6, the maximum of noisy scores): final numbers come from a test set touched once;
• seeds: at least 3 per trained model in Year 1 and at least 5 in Year 2 (Advanced Deep Learning Def. 1.1, the Advanced GNN ch. 1 protocol, Boosting ch. 9);
• in Year 2, significance-aware CI gates (MLOps ch. 2, Def. 2.1, Ex. 6).

Reproducibility and logs

• The repository template of the CS refresher, ch. 3 (pytest, lockfile, Dockerfile, logging) and the training checks of Deep Learning ch. 8 (seeding, overfit one batch, LR range test).
• A weekly log “hypothesis, trial, result, next question” (research internship) and a decision and technical-debt log (Transverse project).
• Year 2 adds artefact lineage for data, prompts, indexes, graph snapshots and adapters (MLOps ch. 1, DVC + MLflow).

Trust work package

Year 1. Each report has a “failure modes and limits” section (leakage, bias, misuse, privacy of the data used) with at least one failure mode measured.

Year 2. A trust work package is mandatory. It holds four pieces:

• a threat model in the format of Security & Robustness Def. 1.1;
• an attack suite scored by attack success rate (ASR) per family, following ESP Ex. 11: 30 attacks, 10 of them adaptive (20 and 5 for a solo variant);
• one uncertainty or privacy guarantee, written up as a “guarantee sheet” in the format of Privacy & UQ Ex. 11;
• successful attacks turned into CI regression tests.

Year 2 red-team swap (W4). Each team attacks another team’s system for one week with a fixed budget, like the simulated post-mortem of MLOps Ex. 12. The defending team reports its detection time and its fixes.

Deliverables

Optional in both years: a “metrics beyond accuracy” paragraph (cost of error in euros, latency, adoption) in the spirit of Introduction to Marketing and Strategy, and a corpus or knowledge-graph bias audit in the spirit of Humanities.

Rubrics (proposal)

Each brief gives its own weighted rubric, adapted from the two templates below (100 points each). When a Year 1 project serves three courses, each course grades its work package on its own row and shares the other rows.

Year 1 projects (end of Period 2)

Several chapters these projects need are taught at the very end of Period 2:

• Graph ML ch. 9 (sessions 10–11) and ch. 10 (session 12);
• RL ch. 6 (sessions 9–11) and ch. 7 (session 12);
• NLP ch. 8 (sessions 10–12).

The milestones put the work that needs them in W3–W5, and each brief says what to read ahead. The Graph ML page itself asks students to read ch. 10 alongside the NLP course.

Y1.1 GraphRAG with a learned retrieval router

Route Graph × LLM. Domain enterprise knowledge, with open-domain multi-hop QA as a measurable proxy (variant: a regulatory or corporate corpus).

Pitch. Build the mini-GraphRAG of the Graph ML final lab properly. Extract a knowledge graph (KG) from the paragraphs of a multi-hop QA benchmark with NER and relation extraction, scored against gold triples, and complete it by KG completion.

Answer each question in four ways: lexical, dense, graph traversal, and pseudo-code prompting over a subgraph. Then let a contextual bandit learn, per question, which retrieval mode is worth its token cost.

Question. On multi-hop questions, when does an LLM-built knowledge graph beat lexical and dense retrieval, and at what token cost? Can a cost-aware contextual bandit learn a routing policy that dominates every fixed retrieval mode on the accuracy–cost plane?

Courses used

• Text Mining & NLP: ch. 1 (normalisation, subword tokenisation); ch. 2 (BM25, inverted index, MAP / nDCG / MRR of Def. 2.7); ch. 6 (NER, BIO decoding, entity-level F1); ch. 7 (Protocol 7.1 fine-tuning, Sentence-BERT); Ex. 14 as the ingestion skeleton.
• Graph ML: ch. 0 (modularity, Louvain / Leiden); ch. 3 (node2vec, Example 3.4) for structural features of seed entities; ch. 6 (TransE, R-GCN + DistMult, link-prediction protocol); Example 8.1 (leakage-free split for KG completion); ch. 10 (10.1 pipeline, 10.2 serialisation and pseudo-code prompting, 10.3 hygiene, final lab).
• Reinforcement Learning: ch. 4 (UCB1, Alg. 4.4 Thompson sampling, Alg. 4.5 LinUCB, regret); ch. 7 (Def. 7.1 POMDP framing, ReAct tool loop, guiding lab and Ex. 18 with cost metrics).
• Machine Learning ch. 4 (metrics, 4.5 calibration, 4.6 reference pipeline); the statistics refresher’s exit checkpoint (paired gains, cluster bootstrap, shuffled-edge control) and its ch. 6.
• Deep Learning ch. 6 (6.4 transformer block) and ch. 7 (7.3 LoRALinear) for the supervised relation classifier. AI-systems students use Deep Learning (P2) ch. 5 for the serving budget instead.
• One elective, to choose:
  • Topological Data Analysis ch. 2 (Def. 2.9 ToMATo), ch. 6 (Mapper) and ch. 7 (bootstrap stability): compare density-persistence clusters of entity embeddings with Leiden communities for the community summaries;
  • or Optimal Transport ch. 5 (FGW, Example 5.5): align the entity sets of two extraction runs;
  • or Multimodal Generative AI ch. 5 (symmetric InfoNCE): fine-tune the dense retriever on question–paragraph pairs.

Objectives. O5 (core), O3, O4, O1, O7, and O8 through citation faithfulness and the re-identification note of Graph ML 10.3.

Data and resources

• 2WikiMultiHopQA (Ho et al., COLING 2020): multi-hop questions with gold supporting facts and evidence triples. The gold triples score the relation extractor. The four question types (comparison, inference, compositional, bridge comparison) give natural strata.
• HotpotQA in the distractor setting (Yang et al., EMNLP 2018) as a transfer check; MuSiQue (Trivedi et al., TACL 2022) as an optional harder set.
• Libraries: spaCy, sentence-transformers, rank_bm25, NetworkX, python-igraph + leidenalg, PyTorch Geometric (RGCNConv; TransE and DistMult in torch_geometric.nn.kge); Microsoft’s open-source graphrag (Edge et al., 2024) as a reference; GUDHI (TDA option), POT (OT option).
• A 7–8B open-weight instruct model (for example Qwen2.5-7B-Instruct or Llama-3.1-8B-Instruct, or a newer model of the same size) served with vLLM or llama.cpp.

Milestones (six weeks; W1 = Graph ML session 9)

Read ahead: Graph ML 10.1–10.2 by W2 (taught in session 12); RL ch. 7 by W4 (session 12).

Deliverables. Repository (ingestion, KG, retrieval, router) runnable with one command; KG export with the source passage of each triple; evaluation notebook; report; defence; datasheet of the extracted KG.

Evaluation (proposed rubric, 100 points)

Solo variant. 300 questions and two question types (bridge, comparison); LLM-only triple extraction, still scored against gold; three modes (BM25, dense, 2-hop graph); Thompson sampling over three arms; the elective as one ablation.

Group variant (4–5). WP-NLP (NER, relation extraction, entity resolution); WP-Graph (KG, completion, communities, graph retrieval); WP-RL (agent, router, cost model); WP-Eval (harness, statistics, error analysis); optional WP-Elective.

Risks and mitigations

• Relation extraction is never taught: NLP ch. 6 names it and the capstone exports “NER + relations”, but the chapter covers only NER. The 2Wiki gold triples give a supervised signal and a scorer; the team documents its method in one page.
• The Graph ML final lab names no corpus, LLM or baseline, and ch. 10 is prose only. This brief supplies them.
• LLM extraction is costly and non-deterministic: cache every call, use temperature 0, log prompts, cap the corpus.
• Memorisation: Wikipedia facts may already be in the LLM. A closed-book baseline serves as a control.
• The test set is small: use paired tests and do not over-read differences inside the CI.

Y1.2 Demand-aware fleet dispatch with natural-language bookings

Route AI systems. Domain logistics (urban fleet operations).

Pitch. A city fleet must decide where idle vehicles wait. Forecast zone-level demand from public trip records with signal-processing models and a spatio-temporal GNN. Learn a repositioning policy with RL in a simulator built from the same records, and accept advance bookings written in natural language.

Then measure how forecast errors and parsing errors propagate to the service rate, within a latency budget per decision.

Question. How much of the gain of a learned repositioning policy over greedy dispatch survives when the policy is fed real forecasts (seasonal and AR models, gradient boosting, spatio-temporal GNN) instead of oracle demand? How much service does a natural-language booking parser lose relative to perfectly structured bookings?

Courses used

• Signal Processing: ch. 5 (digital filtering), ch. 6 (time-frequency analysis), ch. 7 (periodogram, Welch, AR models and Yule–Walker: identify daily and weekly periodicities, AR baselines), ch. 8 (the bridge to graph signal processing: graph Fourier transform, polynomial filters).
• Graph ML: ch. 4 (spectral filters, ChebNet on the zone graph), 5.6–5.8 (temporal graphs and the causality rule), Example 8.1 (time-respecting split).
• Reinforcement Learning: ch. 1 (MDP formulation of repositioning), ch. 3 (Q-learning as a tabular sanity check), ch. 5 (REINFORCE, actor-critic, PPO of Theorem 5.5), ch. 6 (6.1 DQN; Def. 6.5 constrained MDP for a cap on empty kilometres; 6.4 MPC as a model-based baseline).
• Text Mining & NLP: ch. 1 (normalising place names), ch. 6 (sequence labelling, CRF, BIO, entity-level F1), ch. 7 (Protocol 7.1 fine-tuning of a small encoder).
• Machine Learning ch. 4 (temporal validation, leakage) and ch. 6 (gradient-boosting baseline); Refresher in Computer Science ch. 7 (Dijkstra and A* on the road or zone graph) and ch. 3 (repository template).
• Elective: Deep Learning (P2 variant) ch. 1 (counting FLOPs and memory), ch. 5 (efficient inference: int8, batching) and its Example 5.4 (the four-column protocol: quality, p50 / p99 latency, throughput, energy).

Objectives. O7 (core: logistics, real-time constraints), O4, O1, O3 (light: slot filling with an encoder or an LLM), O8 (light: robustness to parse errors, service disparity across boroughs).

Data and resources

• NYC TLC Trip Record Data (New York City Taxi & Limousine Commission): monthly Parquet files for yellow taxis and high-volume for-hire vehicles. The TLC Taxi Zones shapefile (263 zones) gives the zone adjacency graph.
• MultiWOZ 2.2 (Zang et al., 2020), taxi domain (slots departure, destination, leave-at, arrive-by), for slot filling.
• Optional: METR-LA and PEMS-BAY (Li et al., ICLR 2018, DCRNN), standard benchmarks for the spatio-temporal forecaster; OSMnx (Boeing, 2017) for road-network travel times.
• Libraries: DuckDB or pandas, scipy.signal, statsmodels, LightGBM, PyTorch Geometric Temporal (Rozemberczki et al., CIKM 2021), Gymnasium, sklearn-crfsuite, Hugging Face transformers, OR-Tools (assignment baseline), ONNX Runtime.

Milestones (six weeks)

Deliverables. Simulator package with tests; forecasting benchmark; policy checkpoints; the parser with its team-built test set and datasheet; report; defence.

Evaluation (proposed rubric, 100 points)

Solo variant. Manhattan only; AR vs GNN forecasts; tabular Q-learning or DQN; CRF vs few-shot LLM on MultiWOZ only; the DL P2 part reduced to a timing table.

Group variant (4). WP-Forecast (Signal Processing + Graph ML); WP-Simulator and RL; WP-NLP; WP-Systems and evaluation (DL P2 budgets, latency, fairness across boroughs).

Risks and mitigations

• Simulator realism (no traffic dynamics, no driver behaviour): state the assumptions and test how sensitive the conclusions are to them.
• RL instability: start tabular, then go deep; fix the seeds; share parameters across vehicles.
• RL ch. 7 has no multi-agent theory: treat vehicles as independent learners with shared parameters, and say so.
• MultiWOZ is set in Cambridge (UK): report the transfer gap to the team’s New York bookings instead of hiding it.
• AI-systems students take DL (P2 variant) in parallel, so the latency work sits in W5.

Y1.3 Text, knowledge graph and bandits for cold-start news recommendation

Route both (the elective changes with the route). Domain recommendation.

Pitch. News articles are cold by nature: they live for hours. Combine text encoders, the knowledge-graph entities attached to each article and a user–news click graph to score fresh items. Then let a contextual bandit decide what to show. One elective adds privacy, serving efficiency or exposure fairness.

Question. For items with no click history, do knowledge-graph entity signals and graph-propagated user representations improve click ranking over text-only encoders? Does a LinUCB or Thompson policy that uses these representations as context earn more clicks than epsilon-greedy and popularity, in a simulator calibrated on held-out logs?

Courses used

• Text Mining & NLP: ch. 2 (TF-IDF content baseline); ch. 4 (embeddings, SIF); ch. 7 (Sentence-BERT, Protocol 7.1); ch. 8 (8.5: content-based Def. 8.2, matrix factorisation and the hybrid q_i = W x_i of Model 8.3; 8.3: MinHash-LSH to merge near-duplicate stories); Ex. 13.
• Graph ML: ch. 3 (node2vec on the entity co-occurrence graph); ch. 5 (GraphSAGE or GAT on the user–news bipartite graph); ch. 6 (link prediction, PinSage, TransE entity embeddings); ch. 7 (neighbour sampling); Example 8.1 (time-respecting split).
• Reinforcement Learning: ch. 4 (UCB1, Alg. 4.4 Thompson sampling, Alg. 4.5 LinUCB, regret); 6.2 (offline-RL caveats, used to frame off-policy evaluation).
• Machine Learning ch. 4 (AUC, calibration, leakage); Refresher in Statistics ch. 8 (Beta–Bernoulli), Example 3.6 (winner’s curse), 6.6 (multiple testing).
• One elective, by route:
  • Graph × LLM: Emerging Subjects in ML ch. 3 (FedAvg over simulated user devices) and ch. 5 (DP-SGD on the user encoder, privacy accountant);
  • AI systems: Deep Learning (P2 variant) ch. 5 (two-tower serving, int8, batching) and ch. 1 (cost counting) under a latency SLO;
  • either route: Optimal Transport ch. 6 (exposure fairness across categories by OT post-processing) or Optimization for AI ch. 8 (exposure constraint by stochastic primal–dual).

Objectives. O7 (core: recommendation), O4, O3, O5 (knowledge-graph entities × text), O1, O8 (privacy or fairness variant).

Data and resources

• MIND, the Microsoft News Dataset (Wu et al., ACL 2020), in its MIND-small version: impression logs with clicked and non-clicked candidates; news title, abstract and category; entities linked to Wikidata, with pre-trained TransE entity embeddings. Microsoft Research licence (non-commercial research use).
• Optional: the Open Bandit Dataset and Open Bandit Pipeline (Saito et al., NeurIPS 2021 Datasets & Benchmarks; ZOZOTOWN, with a uniformly random logging policy) for an unbiased off-policy check. MovieLens-25M as a fallback.
• Libraries: recommenders-team/recommenders (NRMS and NAML baselines for MIND), PyTorch Geometric (LightGCN, SAGEConv), sentence-transformers, obp.
• Elective libraries: Flower and Opacus for the Graph × LLM variant, with FedNewsRec (Qi et al., Findings of EMNLP 2020) as the reference design; ONNX Runtime for the AI-systems variant; POT for the OT variant.

Milestones (six weeks)

Read ahead: NLP 8.5 (session 11) by W1.

Deliverables. Repository; ranking table (overall vs cold items); bandit regret plots with CIs; the elective result; report; defence.

Evaluation (proposed rubric, 100 points)

Solo variant. Text tower + entity tower + LinUCB; the graph tower reduced to node2vec features; one elective experiment.

Group variant (4). WP-Text; WP-Graph; WP-Bandit and simulator; WP-Elective and evaluation.

Risks and mitigations

• Simulator bias (the policy is evaluated in a model of users the team built): also report results on the logged impressions, and state what each evaluation can show.
• MIND licence: keep the data out of the repository and cite the licence.
• The non-stationarity of news breaks the bandit assumptions of RL ch. 4: test a sliding-window variant.
• DP variant: utility may collapse at small epsilon, so report the whole curve.

Y1.4 Molecules from words: text–graph alignment as retriever, guide and reward

Route Graph × LLM. Domain molecules and healthcare (drug discovery).

Pitch. Learn a CLIP-style space shared by molecular graphs and their textual descriptions. Use it to retrieve molecules from text. Then steer a molecule generator towards a description, by guidance or by RL fine-tuning, and catch the generator when it learns to fool the critic.

Question. Can one contrastive text–graph model serve both as retriever and as reward? At equal sampling budget, does RL fine-tuning (REINFORCE or PPO with a KL anchor to the prior) beat guidance and best-of-N reranking on fidelity, validity and diversity, or does it reward-hack the critic?

Courses used

• Graph ML: ch. 5 (GCN / GIN encoders); ch. 8 (8.2–8.4 EGNN, optional, with RDKit conformers); ch. 9 (9.4 GraphRNN; 9.6 validity, uniqueness, novelty, MMD and FCD; 9.7 conditional generation); Ex. 15.
• Text Mining & NLP: ch. 1 (BPE vs atom-level tokenisation of SMILES / SELFIES); ch. 4 (evaluating embeddings); ch. 7 (fine-tuning a scientific encoder, Protocol 7.1).
• Reinforcement Learning: ch. 5 (5.1–5.2 REINFORCE with baseline; 5.3 PPO-clip, Theorem 5.5); 6.5 (imitation pre-training as the prior); 4.2 (MCTS over graph edits, optional).
• Elective Multimodal Generative AI: ch. 5 (symmetric InfoNCE); ch. 4 (classifier-free guidance); ch. 3 (diffusion, for an optional DiGress-lite); ch. 7 (evaluation, costs, ethics).
• Deep Learning ch. 5–6 (sequence models for the SELFIES language model), ch. 8 (training protocol), ch. 9 (VAE baseline); Machine Learning ch. 4 (scaffold split as a leakage control).
• Optional: Optimal Transport ch. 5 (FGW distance between generated and reference molecule sets).

Objectives. O2 (core), O5 (graph × language), O6 (cross-modal alignment), O4, O1, O7 (molecules), O8 (reward hacking, dual use).

Data and resources

• ChEBI-20 (Edwards, Zhai & Ji, EMNLP 2021, Text2Mol): molecule–description pairs with standard splits.
• ZINC250k to pre-train the generator; MOSES (Polykovskiy et al., 2020) and GuacaMol (Brown et al., 2019) metrics; Therapeutics Data Commons oracles (QED, SA, logP).
• MolT5 checkpoints (Edwards et al., EMNLP 2022) as the text-to-molecule baseline; SciBERT (Beltagy et al., 2019) as the text encoder.
• Libraries: RDKit, SELFIES (Krenn et al., 2020), PyTorch Geometric, Hugging Face transformers.

Milestones (six weeks)

Read ahead: Graph ML 9.4–9.7 (sessions 10–11) by W3.

Deliverables. Repository; retrieval table; fidelity–diversity curves at equal sampling budget; reward-hacking gallery; report; defence; dual-use note.

Evaluation (proposed rubric, 100 points)

Solo variant. Retrieval model + best-of-N + REINFORCE on the SELFIES language model (no diffusion), on a 2,000-description test subset.

Group variant (4). WP-Encoders; WP-Generator; WP-RL and guidance; WP-Evaluation and ethics.

Risks and mitigations

• Multimodal GenAI is a Choose-1 elective: an AI-systems student who took DL (P2 variant) has not seen InfoNCE or guidance. Multimodal ch. 5 (the contrastive loss, about 2 h of self-study) is enough for the solo variant.
• RL collapse or reward hacking: KL anchor, entropy bonus, early stopping on the independent critic.
• ChEBI-20 descriptions are ontology-styled, so exact-match fidelity will be low: report fingerprint similarity and property checks as well.
• Dual use: no toxicity objective; properties restricted to benign targets; a discussion in the report.

Y1.5 Seeing, then reasoning: scene-graph question answering under perception noise

Route AI systems. Domain visual inspection and robotics: questions about objects and their spatial relations.

Pitch. Detect objects in rendered scenes, build a scene graph, parse the question, and answer it with three reasoners over the graph: a symbolic program executor, a question-conditioned GNN, and an RL agent that walks the graph. Then degrade perception step by step and measure which reasoner fails gracefully, and at what latency.

Question. When the scene graph comes from an imperfect detector rather than ground truth, which reasoning layer (symbolic execution, GNN, or a REINFORCE-trained graph walker) loses least accuracy per unit of perception error? Which one meets a per-question CPU latency budget?

Courses used

• Image Analysis and Computer Vision: ch. 9 (fine-tuning a detector, IoU / AP); ch. 5 (projective geometry: from image coordinates to left / right and front / behind relations); ch. 1 (camera model).
• Graph ML: ch. 2 (permutation invariance, graph tasks); ch. 5 (GAT, R-GCN with relation types); 10.2 (serialisation or pseudo-code prompting as an optional fourth reasoner).
• Text Mining & NLP: ch. 6 (sequence labelling for attribute and relation mentions); ch. 7 (fine-tuned small encoder or sequence-to-sequence model: question to program); ch. 1.
• Reinforcement Learning: ch. 5 (5.1–5.2 REINFORCE with a learned baseline); ch. 7 (Def. 7.1: the walker sees only its neighbourhood, a POMDP); ch. 3 (n-step returns).
• Elective Deep Learning (P2 variant): ch. 1 (FLOPs), ch. 5 (efficient inference, int8) and its Example 5.4 (four-column protocol), 7.1 (robustness).
• Machine Learning ch. 4; Refresher in Computer Science ch. 7 (BFS-based program executor) and ch. 3.

Objectives. O6 (core: vision + language), O5 (neuro-symbolic reasoning over a graph), O4, O1, O7 (latency budget, inspection use case), O3 (light).

Data and resources

• CLEVR (Johnson et al., CVPR 2017): rendered scenes with full scene annotations (object attributes, 3D and pixel coordinates, pairwise spatial relations) and a functional program for each question.
• CLEVR-Humans (Johnson et al., ICCV 2017): human-written questions on CLEVR images, for language transfer.
• GQA (Hudson & Manning, CVPR 2019): real images with Visual Genome scene graphs, as a stretch goal.
• Libraries and references: Ultralytics YOLO (detector with attribute heads), PyTorch Geometric, Hugging Face transformers, ONNX Runtime; NS-VQA (Yi et al., NeurIPS 2018) as the reference for program execution, MINERVA (Das et al., ICLR 2018) as the reference for RL path walking.

Milestones (six weeks)

Deliverables. Repository; accuracy–noise curves; latency table; report; defence.

Evaluation (proposed rubric, 100 points)

Solo variant. Gold and synthetically corrupted graphs only (a pretrained detector, or no perception step); two reasoners (executor and RL walker); CLEVR only.

Group variant (4). WP-Perception (Computer Vision); WP-Language (NLP); WP-Reasoners (Graph ML + RL); WP-Systems and evaluation (DL P2).

Risks and mitigations

• CLEVR is synthetic and nearly solved with gold programs: the object of study is degradation under noise, not the headline accuracy.
• Sparse rewards for the walker: a curriculum from one-hop questions; any reward shaping is reported as such.
• Boxes derived from projected coordinates are approximate: document the procedure.
• DL (P2 variant) never defines self-attention: use a BiLSTM-CRF or a few-shot LLM parser, or read NLP ch. 7.

Year 2 projects (Transverse project)

Every Year 2 project follows the same calendar:

• W0, the last weeks of Year 2 Period 1, part time: charter, acceptance tests, data access and licences, a first baseline, compute and euro budget, draft risk register.
• W1–W6, Year 2 Period 2: the build phase. A “walking skeleton” (the thinnest end-to-end version) runs at the end of W1, the red-team swap happens in W4, and the defence follows W6.

The advanced themes of Period 2 are taught during the build phase, so each brief says which chapter to read before which week. Each brief also names fallbacks for slot-TBC courses.

Y2.1 Semi-structured biomedical QA: GraphRAG, GNN retriever or graph tokens, with calibrated abstention

Route Graph × LLM, the flagship for O5. Domain healthcare: biomedical knowledge, not clinical advice.

Pitch. Biomedical questions mix text (“drugs described as kinase inhibitors”) and relations (“… that target a gene associated with disease X”). Over the PrimeKG knowledge base, build three structure-aware retrievers and compare them with a strong hybrid text retriever:

• community GraphRAG;
• a GNN subgraph retriever that feeds soft tokens to an LLM, in the G-Retriever style;
• an agentic router.

Wrap the answers in a conformal abstention layer, and attack the system through poisoned node descriptions. Finally, test whether two tools of spectral shape analysis transfer to knowledge graphs: heat-kernel signatures as structural encodings, and functional maps to align two biomedical graphs.

Question. On a knowledge base that mixes text and relations, for which query types does structure-aware retrieval beat a hybrid text retriever? Can conformal abstention bound the error rate of the answers given without collapsing coverage on relational queries?

Secondary, geometric question: do multi-scale heat-kernel signatures (HKS, computed on the graph Laplacian) help a GNN retriever more than random-walk or Laplacian positional encodings? Does a functional-map alignment of Hetionet to PrimeKG recover the gold correspondences better than name matching?

Usage-based “done” (examples, fixed at W0)

• Hit@5 at least equal to the hybrid baseline overall, and significantly higher on relational queries.
• Error rate on answered questions at or below the target (for example 10 %), at a reported coverage.
• Every answer cites node ids or passages that an automatic checker validates.
• Attack success rate below the agreed threshold after defences.
• P95 latency and cost per 1,000 queries within budget.
• Optional: a 40-question session with two pharmacy or medicine students, timed against PubMed search alone.

Courses used

• Large Language Models: ch. 7 (7.1 chunking of node documents; 7.2 hybrid BM25 + dense + RRF + reranking; 7.3 RAG evaluation; 7.4 GraphRAG); ch. 8 (Def. 8.1 ReAct router; the 8.3 final lab and Ex. 12 as starting code); ch. 9 (9.2 LLM judge, 9.3 hallucinations, 9.4 prompt injection); ch. 4 (SFT of the projector and adapter of the soft-token model).
• Geometric Data: ch. 2 (the Laplacian and its spectrum, here on the KG); ch. 3 (Def. 3.1 HKS, WKS, scale normalisation, the HKS stability bound); ch. 4 (functional maps; correspondence from descriptors); ch. 8 (Connection 1, “operators shared with graphs”; Connection 2, alignment as transport).
• Advanced Topics in LLMs: ch. 1 (1.1 contamination, 1.2 judge calibration); 3.4 (RAG or long context, Self-Route); ch. 4 (memory, GraphRAG); ch. 8 (8.1 serialised graphs, Def. 8.2 G-Retriever); Ex. 12.
• Advanced GNN: ch. 4 (Laplacian-eigenvector PE with SignNet, RWSE of Example 4.2); ch. 5 (graph transformers); 8.3 (GNN × LLM: soft tokens, alignment of spaces).
• Privacy & UQ: ch. 7 (calibration, ECE); ch. 9 (split conformal, Example 9.3); ch. 11 (Def. 11.1–11.2: verbalised confidence, self-consistency, semantic entropy); ch. 12 (Def. 12.2 abstention, risk–coverage).
• Explainability, Security, Privacy of LLMs: ch. 4 (integrated gradients to attribute an answer to passages or nodes); 5.3 (indirect injection, Example 5.2); ch. 6 (Def. 6.1 defence in depth); ch. 10 (red teaming, AI Act); Ex. 8 and Ex. 11.
• MLOps & LLM Engineering: ch. 2 (CI gates); ch. 4 (cost); ch. 6 (6.1 freshness, Def. 6.1 RAGAS, 6.3 the graph in RAG); ch. 8 (tracing).
• Year 1: Graph ML ch. 6 (KG completion) and ch. 10; Text Mining & NLP ch. 2 and ch. 6; Reinforcement Learning ch. 4 (bandit router) and ch. 7; Optimal Transport ch. 5 (FGW alignment baseline, if taken); Deep Learning 7.3 (LoRA); the statistics refresher’s exit checkpoint.
• Ethics seminar (facts / values / options grid): where an exploration tool ends and medical advice begins; the abstention policy.

Objectives. O5 (core), O3, O4, O8, O7 (healthcare), O1.

Data and resources

• STaRK (Wu et al., NeurIPS 2024 Datasets & Benchmarks; snap-stanford/stark), split STaRK-Prime: semi-structured queries over PrimeKG with a text document per node. Official metrics: Hit@1, Hit@5, Recall@20, MRR. Use its human-written queries in addition to the synthesised ones.
• PrimeKG (Chandak, Huang & Zitnik, Scientific Data 2023; Harvard Dataverse).
• Hetionet v1.0 (Himmelstein et al., eLife 2017) for the alignment experiment: shared identifiers on the overlapping node types (genes, compounds, diseases) give gold correspondences.
• Models and references: the MedCPT encoders (Jin et al., Bioinformatics 2023) and a general-purpose embedding model; the G-Retriever code (He et al., NeurIPS 2024); microsoft/graphrag; GRASP (Hermanns et al., 2021) as the reference for graph alignment with spectral signatures and functional maps.
• Libraries: a 7–8B open-weight instruct LLM served with vLLM; PyTorch Geometric; scipy.sparse.linalg.eigsh; RAGAS; MAPIE or a hand-written split-conformal wrapper; DVC + MLflow; OpenTelemetry or Langfuse.
• Domain variant (finance): FinanceBench (Islam et al., 2023) with SEC EDGAR 10-K filings and an LLM-built company graph.

Milestones

Read before: Advanced Topics ch. 8 and Advanced GNN 8.3 by W2; ESP ch. 5–6 by W4; Privacy & UQ ch. 9 and ch. 11 by W4.

Deliverables. A service (OpenAI-compatible endpoint + small UI) with lineage; evaluation report with per-type CIs; risk–coverage plot; attack report and CI tests; model card and datasheet; guarantee sheet (coverage, error rate, limits); ethics memo; 6–8-page paper.

Evaluation (proposed rubric, 100 points)

Solo variant (research pilot). 1,000 STaRK-Prime queries; hybrid baseline vs one structure-aware retriever (k-hop or G-Retriever-lite); the HKS ablation; split-conformal abstention; a 20-attack suite on the solo system; no alignment experiment.

Group variant (4–5). WP-Retrieval (LLM ch. 7, NLP); WP-Graph (GNN retriever, Advanced GNN, Geometric Data encodings and alignment); WP-LLM (soft tokens, router, Advanced Topics); WP-Trust (Privacy & UQ, ESP, red team); WP-Ops (MLOps, cost, CI).

Risks and mitigations

• Synthesised queries may favour text retrieval or carry artefacts: add the human-written queries and 50 team-written questions checked by a domain student.
• LoRA is not taught in the LLM course, whose page refers to a “ch. 6: distillation, LoRA” that does not exist: use Deep Learning 7.3 or MLOps ch. 7.
• Spectral cost on a large graph: only the low end of the spectrum is needed (sparse eigsh, k of about 100–300), or local HKS on k-hop neighbourhoods. Measure the cost in W2.
• Slot-TBC courses: without Advanced GNN, use the Graph ML ch. 5 encoders; without Privacy & UQ, its ch. 9 (conformal prediction) is self-contained enough for self-study.
• Medical risk: the system is for literature and KG exploration. It abstains, cites and carries a disclaimer; the AI Act and the facts / values / options grid go in the memo.

Y2.2 A text-to-3D-molecule copilot with controlled generation and calibrated property intervals

Route Graph × LLM. Domain molecules and pharma (inverse design).

Pitch. A chemist types a property profile in natural language. An LLM agent parses it into a validated specification (grammar-constrained decoding) and calls an E(3)-equivariant diffusion generator and an EGNN property predictor. It returns 3D candidates with conformal property intervals, and it refuses or flags requests that cross a written dual-use policy.

Questions

1. At equal sampling budget, does conditioning an E(3)-equivariant generator on parsed numeric targets give a better fidelity–diversity curve than conditioning on text embeddings?
2. Do conformal intervals from an EGNN property predictor keep their nominal coverage on generated molecules, which are a covariate shift from the training set? Does a weighted or adaptive conformal variant restore it?

Usage-based “done” (examples, for 100 natural-language requests)

• At least 95 % parsed into a valid specification, checked by hand on a sample.
• The median fraction of returned candidates that are valid, unique, novel and inside the requested ranges is above an agreed level.
• The empirical coverage of the property intervals on generated molecules is within 5 points of nominal.
• The false-refusal rate and the miss rate of the dual-use filter are known.

Courses used

• Geometric Data: ch. 7 (Def. 7.1, the EGNN theorem and its proof; numerical equivariance tests); ch. 8 (3D molecules, molecular descriptors, generation by equivariant diffusion).
• Large Language Models: ch. 4 (SFT of a small model for request parsing, if few-shot is not enough); ch. 7 (retrieving known similar molecules and their literature as grounding); 8.1 (tool-using agent); ch. 9 (evaluation, hallucination).
• Graph Generative Models: ch. 5 (Def. 5.1 discrete diffusion, DiGress); ch. 6 (Def. 6.1 MMD; validity, uniqueness, novelty, FCD; lab 1); ch. 7 (Def. 7.1 conditioning mechanisms, 7.2 text-to-graph, Example 7.3 classifier-free guidance); ch. 8 (Def. 8.1 inverse design and Pareto fronts).
• Control in Generative AI: ch. 3 (Def. 3.1 DFA, 3.2 masking: JSON specification and SELFIES grammar); ch. 8 (controlling graph generators); ch. 9 (Def. 9.1 fidelity and diversity, strength sweeps); ch. 10 (Def. 10.3 robustness budget; Theorem 10.1, syntactically valid attacks); Ex. 1.
• Advanced GNN 8.1 (EGNN for 3D molecules) and ch. 2 (expressivity of the property predictor); Privacy & UQ ch. 9 (split conformal), ch. 10 (CQR), ch. 12 (decision and abstention).
• Advanced Topics in LLMs ch. 9 (agent reliability, the p^k law) and 2.3 (RLVR with chemistry-verifiable rewards, optional); Explainability, Security, Privacy of LLMs 5.2 (jailbreaks) and ch. 10 (red teaming of dual-use requests, AI Act).
• MLOps & LLM Engineering ch. 1 (lineage of generator checkpoints, datasets and policy versions) and ch. 8 (tracing the agent’s tool calls, per-request budgets).
• Year 1: Graph ML ch. 8 (EGNN) and ch. 9; Multimodal Generative AI ch. 3–5 (DDPM, guidance, InfoNCE); Reinforcement Learning ch. 5 (RL fine-tuning as an alternative steering); Text Mining & NLP ch. 1 (tokenisation).
• Ethics seminar: the dual-use molecule-generation case.

Objectives. O2 (core), O6 (text + 3D), O4, O5, O7 (pharma), O8 (dual use, uncertainty), O3.

Data and resources

• QM9 (Ramakrishnan et al., Scientific Data 2014): small molecules with DFT 3D geometries and quantum properties. GEOM-Drugs (Axelrod & Gómez-Bombarelli, Scientific Data 2022) as a stretch goal.
• ChEBI-20 (Text2Mol) for text conditioning; MoleculeNet Tox21 for a toxicity flag; Therapeutics Data Commons oracles; GuacaMol multi-property objectives.
• Models: EDM, the E(3)-equivariant diffusion model (Hoogeboom et al., ICML 2022; code e3_diffusion_for_molecules); DiGress (Vignac et al., ICLR 2023).
• Libraries: RDKit (ETKDG conformers; exact descriptors such as Crippen logP, TPSA, molecular weight, QED); GFN2-xTB (Bannwarth, Ehlert & Grimme, JCTC 2019) for cheap geometry and energy checks on a subsample; Outlines or XGrammar for constrained decoding; MAPIE; PyTorch Geometric; vLLM.

Milestones

Read before: Control ch. 3 and Graph Generative Models ch. 7 by W1; Privacy & UQ ch. 9 by W2.

Deliverables. Agent service with constrained tool calls; fidelity–diversity and coverage-under-shift figures; policy evaluation (refusals and misses), without generating hazardous content; model card; ethics memo; paper.

Evaluation (proposed rubric, 100 points)

Solo variant (research pilot on question 2). QM9 only; numeric conditioning only; a released checkpoint; EGNN predictor; conformal coverage under shift with exact RDKit ground truth.

Group variant (4). WP-Generator (Graph Generative Models, Geometric Data); WP-Predictor and UQ (Geometric Data ch. 7, Privacy & UQ); WP-Agent and control (LLMs, Control); WP-Evaluation and ethics (ESP, ethics seminar).

Risks and mitigations

• Training an equivariant diffusion model to paper quality takes several GPU-days: use released checkpoints where available, or a reduced model with fewer diffusion steps, and say so.
• ChEBI-20 molecules are larger and more diverse than QM9: keep the text path in 2D (DiGress) with RDKit conformers, and document the mismatch.
• Several courses are slot TBC (Control, Graph Generative Models, Privacy & UQ). Fallbacks: Graph ML ch. 9, Multimodal GenAI ch. 4, and self-study of Control ch. 3 and Privacy & UQ ch. 9.
• Dual use: the policy restricts targets to benign properties, and red-team prompts are scored on refusal behaviour, never on the chemistry produced.

Y2.3 Speak, see, shop: a voice-first assistant that retrieves and recommends 3D products

Route AI systems. Domain recommendation and e-commerce.

Pitch. A customer describes an object out loud: “a low oak side table with a round top”. The assistant transcribes in streaming mode, parses the request, and retrieves products by fusing text, rendered-image and 3D-shape embeddings. It suggests similar items over a product graph and answers by voice within a latency budget. Seller-written descriptions are treated as untrusted input.

Question. How much retrieval quality is lost from typed to spoken queries (ASR errors, accents, noise)? How much of it does a 3D shape tower trained by text–shape contrastive learning recover, compared with text-only retrieval and CLIP on rendered views? Can the whole loop meet a P95 time-to-first-audio of 1.5 s on one GPU?

Usage-based “done” (examples)

• On 60 hand-written queries spoken by consenting team members in quiet and noisy conditions, nDCG@10 within an agreed margin of the typed version.
• P95 time-to-first-audio at or under 1.5 s at the target load.
• No successful instruction injection from product descriptions in the CI suite.

Courses used

• Speech Technology: ch. 4 (Whisper; Example 4.3 on French WER); ch. 5 (Def. 5.1 streaming latencies, chunking, VAD); ch. 7 (TTS; Example 7.4 latency budget); ch. 10 (conversational loop: endpointing, barge-in); ch. 9 (voice-cloning ethics: no cloning in this project); Ex. 1, 2 and 5.
• Geometric Data: ch. 6 (Architecture 6.1 PointNet, DGCNN, DiffusionNet); ch. 3 (HKS, WKS and ShapeDNA as a non-learned retrieval baseline); ch. 8 (industrial CAD and mesh retrieval; Connection 3, 3D tokens for LLMs); Ex. 11 and Ex. 12 (shape retrieval with mAP).
• Large Language Models: ch. 7 (hybrid retrieval, reranking); ch. 8 (8.1 agent and tools, 8.2 multimodality); ch. 6 (6.4 quantisation, 6.5 serving).
• MLOps & LLM Engineering: ch. 3 (Def. 3.3 serving SLOs: TTFT, TPOT, P99; batching); ch. 4 (euros per million tokens); ch. 5 (drift monitors on queries); ch. 8 (tracing, guardrails); Ex. 3 and Ex. 7.
• Explainability, Security, Privacy of LLMs 5.3 (indirect injection through product text) and ch. 6 (layered defences); Security & Robustness ch. 1 (Def. 1.1), ch. 9 and ch. 10.
• Year 1, signal and 3D: Signal Processing ch. 5–8 (Mel features, noise, resampling); Image Analysis and Computer Vision ch. 10 (point clouds, kNN graphs); Digital Representation and Analysis of Shapes ch. 4 (point processing, normals) and ch. 8 (spectral descriptors).
• Year 1, other: Graph ML ch. 6 (link prediction on an item graph, PinSage); Text Mining & NLP ch. 6 (attribute slot filling: colour, material, size); Deep Learning (P2 variant) ch. 5; Multimodal Generative AI ch. 5 (InfoNCE) if taken, otherwise self-study.

Objectives. O6 (core: speech, language, images, 3D), O7 (e-commerce, deployment), O3, O8, O4, O1, O2 (light: generative TTS).

Data and resources

• Amazon Berkeley Objects, ABO (Collins et al., CVPR 2022): product listings with multilingual metadata, catalogue images and artist-made 3D models (glTF); CC BY-NC 4.0.
• Objaverse (Deitke et al., CVPR 2023) with Cap3D captions (Luo et al., NeurIPS 2023), for text–shape pre-training (stretch).
• Mozilla Common Voice (accented English and French read speech) for robustness; MUSAN (Snyder, Chen & Povey, 2015) for noise.
• Libraries: Whisper (openai/whisper, or faster-whisper), Silero VAD, OpenCLIP, Piper or MMS-TTS, vLLM, trimesh or Open3D, pyrender or Blender for multi-view renders, PyTorch Geometric, FAISS, OpenTelemetry or Langfuse.
• A query set built by the team: 300 queries generated from held-out ABO metadata (gold items known), 60 hand-written queries with graded relevance, and spoken versions (consented recordings by team members, plus TTS renders with MUSAN noise).

Milestones

Read before: Speech ch. 5 and ch. 10 by W3; MLOps ch. 3 by W4.

Deliverables. Deployed demo; retrieval and ASR tables; per-stage latency budget; attack report and fixes; datasheet of the query set; model card; ethics memo; paper.

Evaluation (proposed rubric, 100 points)

Solo variant. Typed and synthetic spoken queries; pretrained Whisper; one shape tower (PointNet) vs CLIP on renders; text replies (no TTS); a latency budget table.

Group variant (5). WP-Speech; WP-3D (Geometric Data); WP-Retrieval and LLM; WP-Ops; WP-Trust.

Risks and mitigations

• Many ABO listings have no 3D model: restrict the catalogue to modelled items.
• ABO is non-commercial: research use only.
• Rendering and point sampling take time: do them offline in W0–W1.
• Voice recordings are personal data: consent, deletion after the study, no voice cloning.
• Speech Technology is an announced, unpublished theme. If it is not offered, use Whisper and VAD as tools, and budget latency with LLM 6.5 and MLOps ch. 3.
• GPU contention between ASR, LLM and TTS: measure it, and quantise.

Y2.4 The natural-language dispatcher: an LLM agent over exact and learned routing with built-in symmetry

Route AI systems, with a Graph × LLM option. Domain logistics (last-mile delivery). This project continues Y1.2.

Pitch. A dispatcher types “add a 15:00–16:00 pickup at stop 42, van 3 is off after 14:00, re-plan”. The agent turns the request into a validated formulation (grammar-constrained), runs an exact solver and a learned neural routing policy, compares them, explains the change, and serves the result under latency SLOs.

The learned policy is invariant to rotations and reflections of the map by construction. It is compared with policies that only learn the symmetry from augmentation.

Questions

1. At equal training budget, does building E(2) symmetry into the neural routing policy (an EGNN-style invariant encoder) generalise to unseen city layouts better than symmetry augmentation (POMO and Sym-NCO style)?
2. Can an LLM agent that delegates to a solver portfolio answer what-if requests on real last-mile routes with route quality close to solver-only and P95 latency within budget? How often does it mis-formalise a request?

Usage-based “done” (examples, on 100 dispatcher requests with gold specifications)

• Formalisation accuracy at or above an agreed level, with zero silent errors: every change is shown and confirmed.
• Route cost within an agreed percentage of PyVRP, and P95 response time under an agreed bound.
• No successful injection through customer notes in the CI suite.

Courses used

• Geometric Data: ch. 7 (Def. 7.1, the EGNN theorem and proof, adapted to E(2); numerical invariance tests); ch. 8 (applications); ch. 0 (reminders).
• Large Language Models: 8.1 (ReAct, tools); ch. 4 (SFT of the request-to-specification parser); ch. 6 (serving); ch. 9 (evaluation).
• Control in Generative AI: ch. 3 (DFA masking for JSON specifications); ch. 10 (Theorem 10.1, syntactically valid injections; Def. 10.3 robustness budget); Ex. 1.
• Advanced GNN: 8.2 (neural algorithmic reasoning); ch. 5 (attention-based graph encoders); ch. 1 (protocol). Advanced Topics in LLMs: ch. 9 (9.1 ReAct, 9.2 Toolformer, reliability per step); ch. 7 (efficiency).
• MLOps & LLM Engineering: ch. 3 (SLOs); ch. 8 (8.1 tracing, Example 8.1 “the budget as the first guardrail”, 8.3 agent evaluation); ch. 2 (CI gates); ch. 9 (sandbox).
• Security & Robustness ch. 1 (Def. 1.1) and ch. 10; Explainability, Security, Privacy of LLMs 5.3 (injection through customer notes and stop names) and ch. 6.
• Boosting to Foundation Models (tabular) ch. 1–3 (gradient boosting for service-time and travel-time prediction) and ch. 9 (honest benchmarking); optional: Privacy & UQ ch. 10 (CQR intervals on travel times, turned into a time-window risk).
• Year 1: Reinforcement Learning ch. 5 (REINFORCE with rollout or shared baselines) and 4.2 (MCTS as search at decoding time); Graph ML ch. 5 and ch. 8; Refresher in Computer Science ch. 7 (Dijkstra, A*); Text Mining & NLP ch. 6 (entity tagging of formulation elements on NL4Opt); Optimization for AI ch. 8 (constraints), if taken.

Objectives. O7 (core: logistics, deployment), O4, O3, O5 (an LLM coupled with combinatorial optimisation on graphs), O8, O1.

Data and resources

• The Amazon Last Mile Routing Research Challenge data set (Merchán et al., Transportation Science 2024; AWS Open Data Registry): real delivery routes in several US metropolitan areas, with stops, time windows, package information, travel-time matrices and the sequences drivers actually followed.
• CVRPLIB (Uchoa et al., EJOR 2017, “X” instances) and the Solomon VRPTW instances.
• NL4Opt (Ramamonjison et al., NeurIPS 2022 competition) for natural-language-to-formulation entity tagging.
• Solvers and learned policies: PyVRP (Wouda, Lan & Kool, INFORMS Journal on Computing 2024), OR-Tools; the RL4CO library (Berto et al.) with its implementations of the Attention Model (Kool, van Hoof & Welling, ICLR 2019), POMO (Kwon et al., NeurIPS 2020) and Sym-NCO (Kim, Park & Park, NeurIPS 2022).
• Libraries: Outlines or XGrammar, vLLM, OpenTelemetry, OSMnx (optional geometry).

Milestones

Read before: Control ch. 3 by W1; MLOps ch. 8 and ESP ch. 5 by W4.

Deliverables. Dispatcher service; symmetry-study figures; taxonomy of formalisation errors; SLO dashboard; attack report; model card; ethics memo; paper.

Evaluation (proposed rubric, 100 points)

Solo variant (research pilot on question 1). Built-in symmetry vs augmentation on CVRP, with rotated and clustered tests and an Amazon subset; the LLM part reduced to constrained parsing of 50 requests.

Group variant (4). WP-Neural routing (Geometric Data, Year 1 RL, Advanced GNN); WP-Agent (LLMs, Control, Advanced Topics); WP-Ops (MLOps); WP-Trust and evaluation.

Risks and mitigations

• Neural routing will not beat PyVRP on quality: the value studied is speed on what-if requests and generalisation, not a new optimum.
• Real-data quirks (coordinates, time windows): budget preprocessing time in W0.
• POMO-style training takes hours per run: use small sizes and few seeds per configuration, as stated in the charter.
• Mis-formalisation: validation plus a confirmation step before any re-plan.
• No course teaches logistics: the references above fill the gap.

Y2.5 Fraud alerts you can defend: temporal GNN, spectral descriptors and grounded LLM narratives under attack

Route both. Domain finance: anti-money laundering on a cryptocurrency transaction graph.

Pitch. Detect illicit transactions on a real transaction graph with a strictly temporal protocol. Compare a tuned gradient-boosting model (GBDT), temporal GNNs and spectral structural descriptors. Attach to each alert a narrative written by an LLM, every claim of which is checked against the evidence subgraph. Then audit the whole pipeline for regime shift, evasion attacks and privacy leakage.

Question. Under a strictly temporal protocol, which signals (account features, temporal GNN embeddings, multi-scale heat-kernel descriptors) add detection value over a tuned GBDT? Which of them survive a budgeted edge-injection attack and the regime shift reported late in the Elliptic timeline? Can an LLM write alert narratives in which every factual claim is verifiable against the subgraph?

The geometric hypothesis comes from the HKS stability bound of Geometric Data ch. 3: descriptors that are Lipschitz in the metric should be harder to move with a few injected edges than learned message-passing features.

Usage-based “done” (examples)

• Recall at a fixed alert budget (for example 100 alerts per time step) above the GBDT baseline, with a CI that excludes zero.
• 100 % of narrative claims machine-checkable, and at most an agreed share flagged false.
• A drift alarm that fires within an agreed number of time steps after the known shift.
• A model card that a compliance reviewer accepts.

Courses used

• Advanced GNN: ch. 6 (TGN, TGAT, strict temporal splits); ch. 7 (robustness and privacy on graphs); ch. 4 (positional encodings); ch. 1 (protocol: at least 5 seeds, CIs); Ex. 8 and Ex. 9.
• Geometric Data: ch. 2 (Laplacian spectrum); ch. 3 (Def. 3.1 HKS, WKS and the HKS stability bound). This is the lightest geometric share of the five Year 2 projects; a team that wants more geometry should choose Y2.2, Y2.3 or Y2.4.
• Large Language Models: ch. 7 (grounded generation over retrieved evidence); 9.3 (hallucination); ch. 6 (serving a small model). Control in Generative AI ch. 3 (constrained narrative template).
• Boosting to Foundation Models (tabular): ch. 1–4 (GBDT, encodings); ch. 9 (honest benchmarking); Ex. 2 (leakage) and Ex. 7.
• Security & Robustness: ch. 1 (Def. 1.1); ch. 9 (graph attacks, Nettack-style); ch. 8 (Def. 8.1 model extraction against the scoring API, Def. 8.3 membership inference); Ex. 9 (threat analysis of a bank scoring system).
• Privacy & UQ: ch. 7 (calibration); ch. 9 (conformal alert sets); ch. 12 (Def. 12.2 cost-sensitive decision, abstention to an analyst).
• Explainability, Security, Privacy of LLMs ch. 4 (attributions and their faithfulness) and 10.2 (AI Act); MLOps & LLM Engineering ch. 5 (Def. 5.1 drift, monitoring loops), ch. 2 (gates), ch. 1 (lineage).
• Year 1: Graph ML 5.6–5.8 (temporal graphs) and Example 8.1; Machine Learning ch. 4 (imbalance, calibration, cost-based thresholds) and ch. 6; Reinforcement Learning ch. 4 (alert-budget bandit, optional); Refresher in Statistics; Introduction to Marketing and Strategy (cost of error in euros).
• Ethics seminar.

Objectives. O8 (core), O4, O7 (finance), O3, O5 (LLM narratives grounded in subgraphs), O1.

Data and resources

• The Elliptic Data Set (Weber et al., KDD 2019 Workshop on Anomaly Detection in Finance; Kaggle): a Bitcoin transaction graph over 49 time steps with anonymised features, about 2 % of transactions labelled illicit. The authors report that models stop detecting illicit activity after a dark-market shutdown late in the timeline: the drift case for MLOps ch. 5.
• Elliptic++ (Elmougy & Liu, KDD 2023): adds the wallet-address graph and features.
• IBM synthetic AML transactions (Altman et al., NeurIPS 2023 Datasets & Benchmarks; Kaggle “IBM Transactions for Anti Money Laundering”): a second, fully labelled setting with amounts, currencies and laundering patterns, which gives the narratives something concrete to say.
• Libraries: PyTorch Geometric (TGN), XGBoost or LightGBM, DeepRobust (graph attacks), SHAP, Captum, MAPIE, vLLM, Outlines, MLflow; PSI and KS monitors, written by the team or taken from a monitoring library.

Milestones

Read before: Advanced GNN ch. 6 and ch. 7 by W2; Security ch. 9 by W4.

Deliverables. Analyst-console demo; per-time-step performance with CIs; robustness curves per signal; narrative faithfulness study; drift report; model card; ethics memo; paper.

Evaluation (proposed rubric, 100 points)

Solo variant. Elliptic only; GBDT vs GBDT + HKS vs TGN; one attack; template narratives with the claim checker (no fine-tuning).

Group variant (5). WP-Detection; WP-Spectral and robustness; WP-Narratives; WP-Ops and drift; WP-Trust.

Risks and mitigations

• Elliptic features are anonymised, so narratives can only cite structure and timing: use Elliptic++ and the IBM data for amounts and patterns.
• Most Elliptic transactions are unlabelled: state how unknowns are treated (excluded, or positive-unlabelled) and test the choice.
• Evasion on public financial data: report attacks at the level the evaluation needs, without operational guidance for real-world laundering.
• The team must check the AI Act classification itself: the creditworthiness item of Annex III excludes fraud detection, but other obligations (GDPR, anti-money-laundering law) remain.
• Slot-TBC courses: without Advanced GNN, Graph ML 5.6–5.8 covers TGAT and TGN at the level needed; without Security, use ESP ch. 5 and Advanced GNN ch. 7.

Objectives and courses at a glance

Objectives × projects

● marks a core objective of the project, graded as such; ○ marks an objective exercised in at least one work package.

O1 is exercised in all ten projects and is core in Y1.2. Every other objective is core in at least two projects. O5, the distinctive emphasis, is core in five projects and O6 in four: on the mandatory path alone, these are the two weakest objectives.

Courses × projects

The projects that use each course in a graded work package; the chapters are in the briefs.

Not used in a graded work package: Computer Animation and Advanced Deep Learning among the 2026–27 electives, and Image Synthesis. Each brief can absorb them as an extra ablation: a crowd simulator as an RL environment for Y1.2, a self-supervised image tower or rendered ABO views for Y2.3.

Existing course material reused

The projects extend labs and exercises that already exist in the notes, instead of starting from nothing.

From a Year 1 project to a Year 2 project

Each Year 1 project prepares a family of research-internship topics, which a Year 2 project can then continue.

Every course’s own projects

Each science course page closes, just before its references, with a Projects and assessment section: solo and group subjects, a written-exam proposal and a grading rubric, all labelled as proposals. For the mandatory courses, see Machine Learning, Deep Learning or Deep Learning (P2 variant), Reinforcement Learning, Graph ML, Text Mining & NLP, Large Language Models and Analysis and Deep Learning on Geometric Data.