So, let's start the river everyone and very happy to be here at this station.
Is it more clear?
So, hello everyone.
It's a big pleasure to be in this station.
It's my first time, as a speaker.
So, I am very impressed to see many people in front of me.
I know that a child but I will try to do my best to give them a more clear answer.
So, this evening we will talk about AI security.
So, we will link to the topics.
AI security.
In order to explain how to an idea that a future against friction in a machine learning system.
I do two things.
So, just an introduction.
My name is Samuel Desso.
I am an IT consultant and trainer.
I am the founder of the society, Irritate, which is best in the front of friends.
Here's a Belgian frontier.
Our job is to implement, we improve monitoring on the service,
on critical infrastructure.
IT, we are not politically, we work on AI.
As we are using a company, we have an example from our team.
We have a company, a partner, a partner, a team, excuse me.
We've picked our metrics, which is a monitoring company.
And now we are talking about this later.
So, we will talk about what we are talking about today.
We will talk about monitoring on AI.
We will focus on security.
So, we will see the problem.
Why machine learning needs a different security?
Before making a deep dive on how can we structure,
and can we develop and approach to develop, to mobilize,
our monitoring on a machine learning attacks.
We will see, after the strikes from a lad, I have a bit.
I will make a demo.
And before seeing more technical on architecture, I will speak.
So, the core question.
Generally, traditional security monitors.
We will register, you can monitor network traffic,
system lock, and so on.
But the core question, we will monitor the AI layer itself.
Why is this question?
Because there is a fact.
You are AI-modest in this particular attacks surface.
On the AI list, several types of attacks.
I can list, for example, the proven injection.
The data design, the algorithm input, model extraction.
It is a very well known attack.
But first, more of an list.
On the AI, I can do the demo after.
So, we have seen new surface attacks.
But the core question, when machine learning system,
are fundamentally different.
So, for me, there is a key point.
The first data is a code.
In traditional software, you can use it with your code.
To understand, there is a better machine learning.
Tuning data has its own logic, so when you inject poison data,
you have to confirm the model with a new code.
The second part is the logic, which is more opaque.
Because you can step through a debugger with a billion of parameters.
It's a very important part.
So, there is no clear execution point.
So, that's all.
Understanding why you model a method of decision,
which is actually a problem yourself.
On the last one, it's a margin of behavior.
Oh, it's a bit more easy for all forms.
So, why I told you about security, the AI, no.
I have put the context.
On the one hand, we will see the fluid landscape in 2026.
The two-panduation is the first one, is the worst element of the token.
We have also more of a six thousand attack technique in the meter at last.
On the other hand, 2026, more than the expression.
So, as a jbreak on the x.
So, it's not a small problem, so it should be.
It is only to become a bigger problem.
So, now, as I have put the context, as a constant part,
I will continue to organize our model from work in a machine learning system.
So, you have four questions to answer.
The answer is the theory vector on the signals.
You have to answer the question to us.
What are we protecting?
This is the model IP.
Is it a training that that privacy?
Or, in particular, is the first part.
In the second part, you have to focus on the other theory.
We will text, is it an external IP address?
Is it, also malicious inside there?
Or, compromise the vendor?
The further part of this framework is the vector.
Or, do the attack for IPI access or training pipelines or the supply chain?
On the last, it's more of the signals.
What detects attacks?
Is it metrics?
Is it log?
Is it traces specific to machine learnings?
I just have a look at the time, okay?
So, we will not make a little dive on the detection of the patterns.
We have three patterns.
The result is in two detection.
The model will be very much including.
On the LSDC security.
So, for each pattern, we have detection signal.
We have metrics, which are based on the vector metrics.
We have a lot of tools.
We need this executioner quiz.
But, no benefit is the demo.
I don't think I will share the results at the end of this talk.
Yes.
Okay.
So, the first, we have another failure in the detection.
The goal is to detect and put craft to fully on the model.
Why they are putting a normal tool to human?
So, the key insight is the sign and put of the signature.
These are some of the icons.
On the icon, the icon, reconstruits your error.
So, that's why we need one for this.
We have four detection signal.
Everything, in which we're concerned, we're concerned about error.
We're instability for prediction.
I will ask you this.
Also, if you do a space in distance,
I'm sorry.
Yeah, this is a demand.
For example, I have, you will see a point where you need tricks.
That's an example.
Or you can look at the position.
The second one, which is the model, the behavior monitoring.
So, in this case, the goal is to detect the positioning on the model,
set by monitoring behavior over time.
So, we have four parts, the prediction is to the distribution route.
We have, with your metrics.
The query patterns, the situation patterns change,
or the performance revision.
So, another one example of a rule.
You can deal with a problem query.
So, the one, it's a dynamic specific security monitoring.
We have to, so, I will discuss the detection
and the detection menu, the direct point injection.
For example, you set to your AI.
If you know, for the pilot's instruction, or whatever,
you have indirect injection.
So, you can put a machine to control the rich with the document.
You are jail-breaking on a data system-point situation.
So, like for the, you have an example of metrics, you can export.
So, I have, so, yeah, I have an example of a description of a,
as a framework of organization of metrics.
How can you build an internal tuning?
So, I have a build a run, which has, in the first run,
a build a critical, a goal to run, to test,
or you can test, you can put your monitoring.
So, I have a build, this stack, with, for tools,
the monitoring, which I have focused on metric on the editing.
We refer to the visualization, and I can,
which is also looking for the regulation of log.
On the open telemetry, only for tracing.
We stack as, for, of course, it's, no vendor looking.
We use less resources.
It is prone to a compacting.
An example of a structure, a looking, with a key.
You have also a look shimmer, with, from machine learning security.
We use the application of queries.
But I will, for, dashboard.
So, in terms of integration, we already take clear.
So, you have this model, you have a machine learning,
you have a model or, you have, you have,
an, for, your pipeline, you have also your expertise.
You have a, on, after, you have, you have so,
So, as we use the open source, we have the chance to have something flexible.
You can also building your customer machine learning security expertise.
So, in this slide, you have an example of an exporter, which is a basic problem with this.
So, now, I have finished with the theoretical part on the open source of the figure.
So, you can do a quick demonstration.
So, you can do a quick demonstration on the open source of the figure.
So, the connection is very slow, but in routing for, I will have, also over.
So, actually, it will be difficult to make the move due to the connection.
So, I will want you to make a live demo, but whatever, I will explain a quick thing.
In this slide, you can make some tests at attack with several levels of security.
So, in this slide, you have three attacks.
And first, I will put model extraction on the problem injection.
So, I have a few, before you will be following this one, I can catch all of this here on this address.
And in addition, obviously, I will show you some fit model from work.
You come, you have some model of primitive selection on the circuit relation.
But what I have present a quick thing, it's a natural reduction.
So, more concentration of the problematic of security on your LLM application.
I think that we would come often, but to be honest, both of this approach, there is some limitation on consideration.
The first one, it's not a cyber bullet, because the pattern I have present, I have this one, detect non-attack signals.
But, if you see everything which concerned, they were there on several techniques and many of the detection insurers.
So, that's alright, this is a difference in depth, not a complete solution.
The second limitation is, if you have a separate requirement, you can switch on the error detection means a training, a training, a auto encoder.
On baseline, there's a decrolibating parameter.
On the other side, that's one, which is a particular pattern.
When you do a monitoring, it is a risk of a further positive.
So, I have a finish with presentation.
So, in conclusion, it is a natural reduction, I have made a natural reduction of a risk topic, which is not so easy to understand for the first time.
I have given some keys on some repairs.
In a one sentence, you have an error mode, it is an attack surface.
So, you have to monitor it like one.
On short question, if you want to take it further, to either we have a plan webinar on a master class.
So, in March 20, 26, we will organize a webinar about this topic.
We will make a dive with demo in life with some attack.
In order to see how you can organize and can do protect your LLN based on the open source monitoring tools.
On April 20, 26, we will organize a master class, but we will focus on an LL1 monitoring activity.
So, we will talk about secreting aspect.
So, thank you, Raymond, for your attention.
So, we've got plenty of time.
So, do we have some questions before we will leave?
Riser hands.
Yeah, thanks for the talk.
So, you mentioned the starting with the high force positive, and then lower it down.
What happens in between?
Do you use the legitimate out of distribution data to fine-tune?
Yes, how do you manage to lower down the force positive?
What happens in between?
Do you use the legitimate out of distribution data to fine-tune?
Yes, how do you manage to lower down the force positive?
Monitoring is an improvement in your model, but it's not the perfect model.
With your utility, you can improve your model.
When you are the first positive, you can improve a choice.
I talked about monitoring, but you have also a possibility.
So, you can improve your model on reduce the part of a false positive.
You can avoid it or whatever you do.
It is a, you can monitor high-tune in a multi-system, you can monitor it, but that's the same thing.
Do we have some other questions in the room?
So, if not, thank you for your presentation.
Thank you for your questions and see you on the next talk.