Coverage note · Financial Crime & AML · Maritime Security · Real-Time + Agentic AI
TRIDENT — Real-Time Maritime Chokepoint Intelligence
A two-speed watch over every ship on Earth: a deterministic detector layer that flags dark fleets, ship-to-ship transfers and blanked transponders 24/7 without an LLM, and a Groq agent swarm summoned only to explain the handful of vessels worth a sentence.
Key metrics
1. Deterministic rules flag; the LLM only explains. A fleetscan service sweeps the Redis geo-index every ~10s with eight versioned detectors (fleet-1.0.0) and never calls a model in the flagging path; Groq llama-3.3-70b-versatile narrates only already-flagged vessels and falls back to a deterministic explanation on rate-limit. The server streams viewport-culled WS deltas (camera-bbox), so the deck.gl map stays smooth at ~14k vessels. Honest framing: with no OFAC list wired in, DARK_FLEET and SANCTIONS_RISK are behavioral proxies — the UI says "possible," never "confirmed."
The problem
Sanctioned "dark fleet" tankers, ship-to-ship transfers in open ocean, and vessels that blank their transponders to slip through a strait are how oil moves around sanctions and how a chokepoint gets blocked. The signal is public — every ship broadcasts AIS — but it arrives as a global firehose of tens of thousands of concurrent vessels with no judgment attached.
The naive build points an LLM at the firehose and melts. The real problem is two-speed: a deterministic layer that watches every vessel on the planet, always-on and cheaply, and a language layer summoned only for the few vessels that actually warrant a sentence of explanation.
Architecture
- 01
Ingest
A single global AISStream WebSocket (live, real ship broadcasts) lands in Redis hot state — one hash per vessel, a geo-index for radius queries, 30-min TTL — fronting a Redis Streams event bus.
- 02
Fast lane (always-on, no LLM)
A fleetscan service sweeps the whole world every ~10s: six per-vessel detector agents (went-dark, shadow-tanker, position-spoof, loitering, aground/blockage, grey-zone) plus two cross-vessel passes (ship-to-ship rendezvous by proximity, sanctions-evasion co-occurrence). Pure-Python rules, composite risk, cooldown/dedupe — 24/7, no model in the loop.
- 03
Slow lane (selective Groq)
A LangGraph agent swarm on Groq llama-3.3-70b-versatile narrates only the vessels the deterministic layer already flagged; on a 429 it falls back to a deterministic explanation, so cognition is never on the critical path.
- 04
Serve
FastAPI streams viewport-culled vessel deltas over WebSocket — the client reports its camera bbox and the server sends only in-view ships out of ~14k — with a TimescaleDB/PostGIS hypertable for durable tracks.
- 05
Command center
Next.js + MapLibre (CARTO Positron) + deck.gl draws every moving ship as a dot at global scale and heading arrows when zoomed; dead-reckoning interpolation and a ~30fps throttled render loop keep it smooth at tens of thousands of vessels.
- 06
Click-to-investigate
Clicking any agent alert flies the camera to the exact vessel, draws its traveled path and current heading, and opens a dossier — what it is, where it came from, which way it is going.
Key tradeoffs
Deterministic detectors decide; the LLM only explains.
WhyYou cannot afford — or trust — a language model to classify tens of thousands of vessels a second. The rules flag; Groq narrates the handful worth a sentence. The flag is reproducible and free; the prose is selective.
Two-speed cognition (10s deterministic sweep + selective Groq), not an agent per ship.
WhyThe fast lane runs 24/7 over the entire globe with zero model calls; the slow lane is summoned only for flagged vessels and degrades to a deterministic explanation on rate-limit, so the LLM is never blocking.
Viewport-culled streaming, not push-everything.
WhyA global feed is ~14k concurrent vessels; shipping all of them to the browser would melt it. The client reports its camera bbox and the server streams only in-view deltas, so the map stays smooth at any zoom.
Honest detectability: DARK_FLEET is a behavioral proxy, not a confirmed sanctions hit.
WhyNo OFAC/sanctions list is wired in, so "shadow tanker" means an old tanker on a flag of convenience that went dark and loitered — a behavioral signature — and SANCTIONS_RISK is a co-occurrence of those signals, never a list match. The UI says "possible," not "confirmed."
Eval results
Six per-vessel agents + two cross-vessel passes over the Redis geo-index; pure Python, versioned (fleet-1.0.0), no LLM anywhere in the flagging path.
Global AISStream WebSocket — real ship broadcasts, ~14k concurrent vessels, ~170 messages/sec observed; no synthetic positions.
~10s deterministic world sweep (always-on) + selective Groq llama-3.3-70b-versatile narration, deterministic fallback on a 429.
deck.gl ScatterplotLayer for global dots, dead-reckoning interpolation, render throttled to ~30fps; viewport-culled WS deltas keep the browser fluid at tens of thousands of vessels.
Production proof
The artifact that keeps the numbers honest: the eval harness and monitoring gates that run in CI, not a one-off notebook result.
Determinism boundary + honest labels
CI · PASSINGThe classification path is pure deterministic rules — versioned and reproducible; Groq is summoned only to narrate already-flagged vessels and falls back to a deterministic explanation on rate-limit. Dark-fleet and sanctions-risk are framed honestly as behavioral signatures — there is no sanctions list, so the system says "possible," never "confirmed."
Turns the raw global AIS firehose into a live, always-on watch for the maritime behaviors that matter — dark fleets, ship-to-ship transfers, blanked transponders, blocked chokepoints — with a deterministic core that runs 24/7 for pennies and a language layer summoned only when there is something worth saying, on real, live, open ship-broadcast data.
Request coverage
I am focused on finance AI: credit risk, RegTech, AML, and agentic investment research. Open to roles, mentorship, and collaborators in fintech, quant, and bank AI.