Kostiantyn Dementiev

I'm a systems researcher and senior platform engineer. I study tenant isolation in shared systems: when one tenant can read another's data, how to test for it, and what correct isolation costs.

Since 2022, I've been a backend and platform engineer at a digital analytics SaaS that audits enterprise websites for analytics and privacy compliance, with over 100 TB of data per year. I hold a BSc in Computer Science from Taras Shevchenko National University of Kyiv, where my thesis on multi-tenant Spring Boot applications started this line of work. I also founded OpsServing, a DevOps and cloud consultancy.

Email  /  CV  /  GitHub  /  ORCID  /  LinkedIn  /  Medium  /  Credly

Research

My work began with database-per-tenant applications and now covers multi-tenant LLM serving, where tenants share a base model and its prefix cache but bring their own LoRA adapters. Right now I'm measuring whether the optimizations that make multi-adapter serving cheap also open channels between tenants: prefix-cache timing, batching interference, adapter memory left after eviction, and the scheduler's admission path. The goal is a ladder of defenses, each with a measured throughput cost, and an open test suite operators can run on their own deployments.

All manuscripts below are single-author.

In 31 of the 32 vLLM releases I tested, same-named LoRA adapters of different tenants shared prefix-cache blocks, enough for an attacker to tell a victim's fine-tuning domain among 4 candidates 9 times out of 10. Keying the cache on a digest of the weights costs about 3% of throughput, against 66 to 79% for the usual fixes.

The method adds tenants to a running system without restarts. On Kubernetes, all replicas converged in each of 160 provisioning runs, with a median of 419 ms at 3 replicas.

Replacing the routing table in place sent 939 of 120,000 lookups to the wrong tenant's database, and atomic replacement sent none of 1,215,000. The protocol caught all 12 mutants, and the existing tests caught only 1.

The model treats each tenant's connection pool as a time-to-live cache. On minikube and Amazon EKS, it predicts the mean of every pooler-free configuration to within 4%.

Smaller studies

• retry-storm-metastability: an independent reimplementation of the retry-storm model from "Modeling Metastability" (HotNets '25), with a few experiments on top of it.
• observer-blur-coverage: how often a fixed-size face blur fully covers a face in the video stage of MedVidDeID, a pipeline that de-identifies clinical video.

Open source and research artifacts

I run released artifacts of recent systems papers (150+ so far) and send fixes upstream when something breaks. Merged fixes include:

• Pie, a programmable LLM serving system: every session ran under the same name, so any client could list, attach to, or terminate other users' processes. PRs #1101, #1100
• SREGym, a benchmark of AI agents resolving production incidents: three grading oracles accepted wrong fixes, such as an image that never starts. PRs #1107, #1108, #1109
• ZMap, the Internet-wide scanner (6.4k stars): a single BACnet or DNS reply could end a whole scan, and TCP option parsing could read past the captured packet. PRs #984, #983
• PyHealth, a deep learning toolkit for healthcare (1.7k stars): its cleanup deleted other jobs' temp folders on a shared cache. PR #1296
• Cleaning the NTP Pool, artifacts of a CCS 2026 paper: the IPv6 traceroute never probed the last hop limit. PR #1
• Redash, a BI tool (29k stars): Google sign-in now works behind a load balancer that terminates TLS. PR #7178, docs in website#775

Industry

Backend and platform engineer since 2022 at a digital analytics SaaS (26 data processing and reporting services, over 100 TB of data per year). I joined as a backend developer and took over most of the platform work in late 2023.

• Led the design of components in the data pipeline that processes over 100 TB a year, and worked on the Snowflake lakehouse and the replication that keeps personal data out of the analytical copy.
• Benchmarked four ways to read 2.1 million small S3 files. Compacting them with Athena before loading into Snowflake let a backfill that had failed after 4 hours finish in about 6 minutes, and a K-means model of object sizes showed that deleting early beat lifecycle expiry for 97% of files.
• Traced recurring Step Functions failures in a production data-deletion pipeline to memory-starved containers that let task tokens expire, and rolled the fix out to 9 services.
• Co-designed consent-status resolution for the privacy-compliance product. Trackers that matched no consent category were silently given the wrong status, and one shared SQL function now reports them as uncategorized.
• Found why tripling a tenant's concurrency limit from 10 to 30 left throughput flat (one audit per tenant per scheduler cycle) and proposed a bounded per-tenant admission rate.
• Traced a tenfold latency spike at double the request rate to connection-pool starvation, and the fix cut the endpoint's CPU use by 34%. Cut an enterprise report page's load time from 17 s to under 2 s, and a 10-table query over about 10 TB from 21 s to 2.1 s.
• Replaced long-lived CI keys with OIDC roles across about 30 repositories, prototyped cross-customer isolation for the company's GitHub App (an installation is accepted only if the organization owns it and the user administers it), and helped with security hardening for SOC 2.
• Led the platform modernization: 11 services moved from Rancher to ECS and Fargate, 11 Jenkins pipelines to CircleCI, Consul retired across 8 services, and Redis moved to ElastiCache without downtime. AWS costs fell by 45% and incidents by over half.
• Wrote about 20 design documents, have led weekly incident reviews for the reporting services since 2023, and mentored two junior developers.

Before that, I was a Java developer at Impltech (2021-2022).

Honors

• Product and Engineering Team Member of the Year 2025, Ukraine
• Operational Excellence Champion in 3 of 13 quarters since Q3 2023, the most of any recipient
• Take Accountability award 2024, for the Rancher, Jenkins and Nexus migrations
• "Most Impactful" at the company's AI hackathon 2023, for an AI grammar and spelling checker
• 1st place in the 2021 KNU Student Mathematics Olympiad, with 50 of 50 points

Education

BSc in Computer Science, Taras Shevchenko National University of Kyiv, 2025. One of the top 3 diploma marks in a group of 22 students. Thesis: Methods for Building Distributed Multi-Tenant Applications with Spring Boot, graded 95/100.

Certifications

• 2026: AWS Certified Security Specialty, Certified Kubernetes Security Specialist (CKS), Snowflake SnowPro Core
• 2025: Certified Kubernetes Administrator (CKA), Certified Kubernetes Application Developer (CKAD)
• 2023: AWS Certified Solutions Architect, SysOps Administrator and Developer Associate, HashiCorp Certified: Terraform Associate

Writing and community

• Five technical articles on Medium with about 20,000 views, and one on DOU, Ukraine's largest developer community, with 3,000+ views
• Volunteer DevOps engineer for Charity Hero, which distributes humanitarian aid in eastern Ukraine
• Built Ty yak?, a check-in app for air raids and other emergencies

Template from Jon Barron's website.