WEBVTT

NOTE Sentence-level transcript of https://www.youtube.com/watch?v=2WZsT-znFTQ

NOTE One cue per sentence. Cue ids are the line anchors on /transcripts/2WZsT-znFTQ.html. A cue ends where the next begins, or 2 s after its last word.

s1
00:00:01.309 --> 00:00:03.309
[music]

s2
00:00:12.880 --> 00:00:28.760
By the time this presentation ends, someone, somewhere will make life-altering decisions based on something generated entirely by AI.

s3
00:00:30.360 --> 00:00:38.960
Last 30 years, digital infrastructure is based on these unwritten rules.

s4
00:00:39.200 --> 00:00:47.080
If you see a face or you hear a voice, you trust someone behind it.

s5
00:00:47.080 --> 00:00:53.240
If you see a signature, you trust someone has approved it.

s6
00:00:53.240 --> 00:01:03.000
Every business transaction, every government workflow is based on this foundation of trust.

s7
00:01:03.000 --> 00:01:12.360
So, trust is a invisible layer on top of it all this digital infrastructure based on.

s8
00:01:12.640 --> 00:01:17.840
But, generative AI trashed it completely.

s9
00:01:17.840 --> 00:01:20.920
AI agent can clone a voice.

s10
00:01:20.920 --> 00:01:25.320
Synthetic face can bypass identity check.

s11
00:01:25.320 --> 00:01:36.120
AI can impersonate people at a speed no criminal organization have been able to do that before.

s12
00:01:36.120 --> 00:01:44.440
So, in the era of generative AI, seeing is no longer believing, neither is hearing.

s13
00:01:44.440 --> 00:01:53.520
The cost of deception is collapsed and the speed of deception is exploded.

s14
00:01:54.360 --> 00:01:56.760
Hi, my My is Rachna Srivastava.

s15
00:01:56.760 --> 00:02:02.760
I work for California Department of Financial Protection and Innovation.

s16
00:02:02.760 --> 00:02:11.600
Our mission is to protect 39 million Californian and their financial identities.

s17
00:02:11.600 --> 00:02:13.880
Let me tell you what we do.

s18
00:02:13.880 --> 00:02:26.280
When a massive fraud attack in in the state of California, we identify the fraud, we examine the fraud, and we run enforcement.

s19
00:02:26.280 --> 00:02:29.840
Let me take you behind the scene what we actually do.

s20
00:02:29.840 --> 00:02:33.400
Fraud comes, we investigate the fraud.

s21
00:02:33.400 --> 00:02:38.320
When the investigation happen, we collect all the evidences for the fraud.

s22
00:02:38.320 --> 00:02:43.760
When we have all the evidence, we take that evidence to the court.

s23
00:02:43.880 --> 00:02:54.320
And in the court, the defense attorney has only one job, to attack the system that we have built.

s24
00:02:54.360 --> 00:03:02.000
So, the question arises, how should we build a system which is credible?

s25
00:03:03.239 --> 00:03:11.320
What are the attributes we need to have in a system which can appear in the court?

s26
00:03:11.320 --> 00:03:16.280
And appear in the court means system should be defendable.

s27
00:03:16.280 --> 00:03:23.239
Defendable means it should be we should be able to explain the system at every step of the process.

s28
00:03:23.239 --> 00:03:27.720
We should be able to reproduce the issue at every step of the process.

s29
00:03:27.720 --> 00:03:40.640
We should be able to audit the issue at every step of the process because everything, every data that we produce, it's going to appear in the court.

s30
00:03:40.640 --> 00:03:43.840
So, how do you build that kind of system?

s31
00:03:43.840 --> 00:03:51.600
You Since we deal with financial data, we have to ensure that the data is secure for sure.

s32
00:03:51.600 --> 00:03:57.400
We have to ensure that the data is evolving and learning.

s33
00:03:57.400 --> 00:03:57.840
Why?

s34
00:03:57.840 --> 00:04:01.440
Because the fraud space is changing every day.

s35
00:04:01.440 --> 00:04:10.360
We have to ensure that the data is available to be appear in the court and reproducible.

s36
00:04:10.360 --> 00:04:21.160
So, what I'm going to show you now, the system that we built, and the lessons we have learned the hard way.

s37
00:04:21.160 --> 00:04:30.880
So, the first and foremost decision that we have taken was to build our solution offline.

s38
00:04:31.120 --> 00:04:35.240
So, you might be wondering like it's it's extreme.

s39
00:04:35.240 --> 00:04:44.440
Like, why are you Okay, why do you want to create a solution offline when we have a secure cloud?

s40
00:04:44.560 --> 00:04:54.600
So, before we show you what we build, let's talk about what do industry do in the normal way.

s41
00:04:54.600 --> 00:04:59.400
So, the gold standard of security is encryption.

s42
00:04:59.400 --> 00:05:06.720
Encryption means you encrypt the data at rest or encrypt the data on the transit.

s43
00:05:06.720 --> 00:05:21.160
That means the thing is but for machine learning model to work, the data has to be decrypted and available in the plain text in the model memory.

s44
00:05:21.160 --> 00:05:30.280
And if the data is already decrypted and present in the plain text, it is prone to prompt injection attack.

s45
00:05:30.800 --> 00:05:33.600
Secondly, let's talk about private endpoint.

s46
00:05:33.600 --> 00:05:42.560
Private endpoints are actually a isolated environment given to you from your cloud provider.

s47
00:05:43.160 --> 00:05:51.480
But cloud providers actually own the on the on the disk.

s48
00:05:51.480 --> 00:06:10.640
So, the question the thing is that according to the Cloud Act federal government can access your data which is in the cloud and they don't even have to tell you that your data have been accessed.

s49
00:06:11.560 --> 00:06:14.760
Let's talk about certification.

s50
00:06:14.840 --> 00:06:20.080
FedRAMP compliant, I also certified SOC 2 compliant.

s51
00:06:20.080 --> 00:06:24.919
All these compliance are just paper.

s52
00:06:24.919 --> 00:06:35.800
And we have seen these highly compliant organization fail over and over again.

s53
00:06:35.800 --> 00:06:51.120
So, only way you can make your data secure to be available in the court to present as a as a evidence is to build the solution offline.

s54
00:06:53.720 --> 00:07:07.720
So, like everyone else we thought like what a big deal, let's just download a open-source model, create an isolated environment, spin up some GPU, add some system prompt, and add some guardrails,

s55
00:07:07.720 --> 00:07:09.400
and done we are running.

s56
00:07:09.400 --> 00:07:12.080
Push the live data into it.

s57
00:07:12.080 --> 00:07:15.080
We did the same like everyone else.

s58
00:07:15.080 --> 00:07:21.320
And the model the system collapsed in 2 hours.

s59
00:07:22.160 --> 00:07:29.440
And our first instinct was you know, we took the model free model from online.

s60
00:07:29.440 --> 00:07:34.440
Model is not good for our use case.

s61
00:07:35.360 --> 00:07:48.000
But the issue was we were we were treating machine learning model as a magic box instead of as a data pipeline.

s62
00:07:49.520 --> 00:07:58.560
So, anything that garbage comes into the system, we were expecting the model to clean up and do all the processing.

s63
00:07:58.640 --> 00:08:10.920
So, to solve this problem, we introduce Kafka for data ingestion, a Spark for data processing, and large language model for reasoning.

s64
00:08:10.920 --> 00:08:17.000
Three different tools to solve three different problems.

s65
00:08:18.000 --> 00:08:22.080
We use Kafka for these three things.

s66
00:08:22.080 --> 00:08:30.919
First, the data that enter into our system does not come at a consistent speed.

s67
00:08:30.919 --> 00:08:35.840
When a fraud attack happen, it attack all over the state.

s68
00:08:35.840 --> 00:08:40.320
So, we get a high spike of traffic into our system.

s69
00:08:40.320 --> 00:08:51.600
So, we needed a tool that can buffer that traffic so that the downstream component can access the data at a consistent speed.

s70
00:08:51.600 --> 00:08:53.800
And Kafka did that.

s71
00:08:53.800 --> 00:09:05.000
Secondly, we wanted all the events that occur in the system to come and store in a sequential order.

s72
00:09:05.000 --> 00:09:06.960
When did you open the account?

s73
00:09:06.960 --> 00:09:08.600
When did the transaction happen?

s74
00:09:08.600 --> 00:09:13.880
The order of events in the fraud is extremely important.

s75
00:09:13.920 --> 00:09:16.720
Kafka helped us solve that problem.

s76
00:09:16.720 --> 00:09:24.640
But the main problem that Kafka helped us solve is reproducibility.

s77
00:09:24.839 --> 00:09:34.600
In Kafka, it let you move the checkpoint to the point at which the decision was made, and it helped you replay the event.

s78
00:09:34.600 --> 00:09:42.960
And this replayability of the event is the proof that we present in the courtroom.

s79
00:09:44.080 --> 00:09:49.560
So, now Kafka did solve our data storage problem.

s80
00:09:49.560 --> 00:09:54.600
But, the data that enter into the system is really messy.

s81
00:09:54.600 --> 00:09:57.880
We get 10 different format of bank statement.

s82
00:09:57.880 --> 00:09:59.520
We get audio file.

s83
00:09:59.520 --> 00:10:04.880
We get screenshot, facts statement.

s84
00:10:05.160 --> 00:10:12.840
And, if you dump all this data to model memory, then no wonder model hallucinate.

s85
00:10:13.440 --> 00:10:27.560
So, we introduced a Spark because a Spark let us process this data behind the scene in the clusters of CPU instead of working on GPU.

s86
00:10:27.560 --> 00:10:32.200
And, Spark let it let us clean the data.

s87
00:10:32.200 --> 00:10:45.880
And, then when we process send the clean data through the model memory, to our utter surprise, the same model started giving us so good results.

s88
00:10:45.880 --> 00:10:51.760
It found the connection between the points which we never thought expected.

s89
00:10:52.920 --> 00:10:55.480
So, we learn our first lesson.

s90
00:10:55.480 --> 00:11:06.920
The lesson is most of the data problem in AI are data engineering problem wearing AI mask.

s91
00:11:06.920 --> 00:11:14.200
So, I recommend you to consider using data engineering tool to solve those problems.

s92
00:11:14.720 --> 00:11:21.800
Now, our model memory is filled with a very condensed clean data.

s93
00:11:22.000 --> 00:11:24.920
But, then we found our next issue.

s94
00:11:24.920 --> 00:11:30.760
The issue was the memory was filled with lot of sensitive information.

s95
00:11:30.760 --> 00:11:37.720
Your credit card number, your bank account number, your social security number.

s96
00:11:37.720 --> 00:11:42.600
So, we introduce something called cryptographic vault.

s97
00:11:42.600 --> 00:11:51.160
Which is basically a SHA-256 cryptographic algorithm with hardware security module.

s98
00:11:51.400 --> 00:12:03.840
So, in the simple sense, it means that as we get the data into the system, cryptographic vault which convert the data into cryptographic hash.

s99
00:12:03.840 --> 00:12:13.000
But, the key that is used to do the conversion is physically attached to our server rack.

s100
00:12:13.000 --> 00:12:28.080
So, if tomorrow somebody is able to get our data, they have to walk into our office physically, break the server rack, get the key to actually make sense of the data.

s101
00:12:28.480 --> 00:12:30.600
Then, we learn our second lesson.

s102
00:12:30.600 --> 00:12:39.640
If the stakes are really high, trust hardware over software.

s103
00:12:41.160 --> 00:12:45.600
Now, we have a model which is working really well.

s104
00:12:45.600 --> 00:12:48.520
All the PII is redacted.

s105
00:12:48.520 --> 00:12:54.280
We thought, let's just run a quick round of load testing and release this product.

s106
00:12:54.960 --> 00:13:01.160
The problem is in the cloud, the scaling is unlimited.

s107
00:13:01.160 --> 00:13:10.640
You get a high spike of traffic, it is spins off more server, it's it's distribute the load to those server, and you are done.

s108
00:13:10.640 --> 00:13:19.520
But, when you are creating an isolated environment, you have limited GPU, limited compute, limited VRAM.

s109
00:13:19.520 --> 00:13:25.720
So, we have to step back and figure out what is the actual problem here.

s110
00:13:25.720 --> 00:13:35.560
The problem was we were using one state of the art machine learning model to do every single processing.

s111
00:13:35.560 --> 00:13:44.160
The same model was doing the summarization, entity extraction, fraud ring detection.

s112
00:13:46.320 --> 00:13:54.760
So, we were actually making a neurosurgeon take the blood pressure of every single patient.

s113
00:13:55.000 --> 00:14:02.200
To solve this, we introduced triage nurse or semantic router.

s114
00:14:02.200 --> 00:14:16.560
And the goal of semantic router is as we get the data, it analyzes the data and forward the request to the smallest possible model which is capable of processing

s115
00:14:16.560 --> 00:14:18.880
that request.

s116
00:14:19.880 --> 00:14:36.440
And by making this simple architecture change, we found that more than 80% of of our task could be easily done by the smallest, fastest, cheapest model.

s117
00:14:36.560 --> 00:14:51.480
By not adding any new GPU, we could process three times more traffic and cost of processing each request reduced to nearly 70%.

s118
00:14:55.839 --> 00:15:07.520
Now, we have done the unit testing, we have done the load testing, and then we found the hardest problem of all.

s119
00:15:08.520 --> 00:15:18.880
The problem was we built this highly secure system, but the system was not learning.

s120
00:15:19.600 --> 00:15:24.200
System did not know what is happening in the threat space.

s121
00:15:24.200 --> 00:15:33.560
So, the question arises, how do we make our system learn without creating a security hole?

s122
00:15:36.000 --> 00:15:43.200
Usually in industry, people solve this problem by configuring software firewall.

s123
00:15:44.200 --> 00:15:48.520
But any configuration can be misconfigured.

s124
00:15:48.520 --> 00:15:56.400
And once you have misconfigured, your highly secure system will be highly exploited one.

s125
00:15:57.200 --> 00:16:04.160
We decided to not trust the configuration, and we took help from physics.

s126
00:16:04.560 --> 00:16:16.560
We introduce one-way data diode, which is basically a fiber optics cable physically cut into half.

s127
00:16:16.560 --> 00:16:22.440
The first half of the cable is connected to the internet to receive the data.

s128
00:16:22.440 --> 00:16:26.760
Second half of the cable is connected to our solution.

s129
00:16:26.760 --> 00:16:36.266
First of the half of the cable has laser transmitter, which receives the data from the internet and transmit the data to the second half.

s130
00:16:36.266 --> 00:16:36.400
[snorts]

s131
00:16:36.400 --> 00:16:41.920
Second half has a laser receiver to receive the data from the first half.

s132
00:16:41.920 --> 00:16:48.280
But there is no laser transmitter from our end to the outside world.

s133
00:16:48.280 --> 00:16:55.800
So, it is physically im- possible for data to leak from the system.

s134
00:16:55.800 --> 00:17:04.680
And this is how we ensure 100% guarantee of the security of the system.

s135
00:17:09.760 --> 00:17:15.360
Data diode solves the problem of directionality of the data.

s136
00:17:15.360 --> 00:17:23.680
But anything enter into the data is is considered to be unsafe till proven.

s137
00:17:23.680 --> 00:17:30.640
So anything from outside first first lands into quarantine zone.

s138
00:17:30.640 --> 00:17:36.560
Where we run a spark job that runs a validation on each input data.

s139
00:17:36.560 --> 00:17:44.520
And when all the validation is successful, then the data goes to the production layer.

s140
00:17:45.280 --> 00:17:52.240
In the production layer, we also save the data into Apache Iceberg.

s141
00:17:52.400 --> 00:18:01.480
Apache Iceberg is a time traveled queryable immutable data store.

s142
00:18:02.880 --> 00:18:15.280
We enter the data in this data store because 2 years from now one of our results from our system goes to the court.

s143
00:18:15.280 --> 00:18:18.760
We cannot present We cannot go to the court and tell them, "You know what?

s144
00:18:18.760 --> 00:18:25.840
This system is result is produced by AI and we don't know anything about it."

s145
00:18:26.120 --> 00:18:41.320
At that moment, we travel the Apache Iceberg, go to the point at which the decision was made and get the state of the system at that moment from the database.

s146
00:18:41.320 --> 00:18:48.680
And that is state of the system appear as a proof in the court.

s147
00:18:49.400 --> 00:19:03.840
And that is how we build a solution which is secure, which is evolving, and which is defensible in the court.

s148
00:19:07.920 --> 00:19:11.160
This is the whole architecture end to end.

s149
00:19:11.160 --> 00:19:25.360
If you see this only at the very end of the system, we are when a user logs into the system, they we authorize the user into multi-factor factor authorize

s150
00:19:25.360 --> 00:19:30.920
authentication and only then the data is reverted.

s151
00:19:30.920 --> 00:19:41.720
Data is not opened till the very end at the browser where the user is actually evaluating the threat case.

s152
00:19:45.520 --> 00:19:49.520
So, don't look at the solution as a fraud detection solution.

s153
00:19:49.520 --> 00:19:53.800
This is the architecture of the future.

s154
00:19:53.800 --> 00:20:04.280
Soon the same architecture will be used to predict the health care, banking e-statements, legal and other domains.

s155
00:20:04.560 --> 00:20:08.480
In the end, I just want to say one thing.

s156
00:20:08.480 --> 00:20:13.400
Build solution that can be trusted.

s157
00:20:13.720 --> 00:20:17.880
And remember, trust is not a policy.

s158
00:20:17.880 --> 00:20:22.320
Trust is a physical property of the system.

s159
00:20:22.320 --> 00:20:33.440
You have to build the trust from day one into your hardware, into your physics, into your architecture or it's not there.

s160
00:20:33.440 --> 00:20:35.080
It's that simple.

s161
00:20:35.080 --> 00:20:38.920
So, years from now nobody will remember the models you trained.

s162
00:20:38.920 --> 00:20:42.120
Nobody will remember the benchmark you received.

s163
00:20:42.120 --> 00:20:53.040
People will only remember the solution that you have built can be trusted when it needed the most.

s164
00:20:53.040 --> 00:20:55.480
Thank you so much.

s165
00:21:10.714 --> 00:21:12.280
[music]

s166
00:21:12.280 --> 00:21:14.280
Mhm.