Thank you so much for your time.

Yeah, yeah. I’ll take a closer look at these again, negotiate, and try to reach the deals and solutions, so I’ll definitely see how they fit together.

Tangible gratification.

It’s an inspiring discussion. I’m also very excited to see you. I’ll definitively look at these and we’re so excited about the negotiations, language models, and the assembly ideas. It was inspiring. So, thank you very much.

Usability matters. So, getting things on the street in the end, that’s a massive, I think that’s something we learned. Also with AI, I think that bridge also having developers that understand AI machine learning, people that use it, but also the process, that’s why we also try to set ...

And you can try to do it by design, having crypto till the end, but convincing all the high-frequency researchers to change all their ways, and it’s a difficult job. So, I think that’s where I’m still struggling with it.

So, yeah. I only partially involved in this, I have some colleagues from our EP network, that I’m more closely talking to them. But I think they’re mostly, again, betting on secure processing environments, but if you have so many member states, and each member state has a bunch of ...

But yeah, I’m also more concerned about these last European issues. They put security stamp here, privacy, and nobody knows really what that actually means in the end. And that’s all supposed to happen, but I’m missing the bigger concept right now, how they want to actually do this.

Looking at consensus, and also get people to engage in this, take some convincing. Right now, I think they want to look at health record, image data, and I think genetic data, the three pilots, you all are looking at in that project. And I’ve been coordinating over the last ...

Yeah, again, we also have a correlation with multiple hospitals in Germany, kind of looking at federated learning and looking at different infrastructures…

But I think with many of the cryptographic protocols, as long as you stay in the domain, it’s fine. But in the end, you want to train a model, you want to do inference. So, the inference result ends up somewhere, I guess. That’s the question. If this is also ...

But in the end, the result has a certain end point. At some point, it leaves the cryptographic domain. This is still the point, what happens with the results. If they are strongly aggregated, then you can make a point it’s not conflicting with privacy.

So, that’s again why we probably, in the long run, will benefit from both sides, we get better models by understanding the biology better, maybe also at some point the models will teach us more about the biology. But again, right now we are still at the earlier end, but ...

Yeah, but again, we look at, for example, genetic data, for gene expression data, it’s quite easy to get downstream utility for certain training tasks, but then if you look at the biological plausibility, it’s like, not good. As a gene co-expression, it’s not really preserved. And that’s the thing, ...

Exactly, yeah. And then what we did, we either train the generators, or we also look at core set distillation, that we have a few… basically, we directly optimize the prototypes, so to say. And so, this just means that we have differential privacy in the training procedure.

So, this just means, this is an DP, I think, such that we have strong guarantees by differential privacy. So, we either train generators with differential privacy, so basically, the parameters cross the privacy boundary…

Yeah, yeah. So, o that’s why we have quite a few projects. And also, excitement, I think, from the health people. I think it’s also a chicken-and-egg problem. As we get better synthesizers, people will understand the data better. The better we understand the data, we can also put more ...

It has a bit of the similar issues. Minority groups might not be well-represented. But we still think that can be true anonymous data, and the kind of vision that we think we want to pursue is there. But there can be exploratory data analysis on this as a proxy, ...

Yeah. Many issues. I think with health, we work in quite a few of the health centers. Again, with the Cancer Research Center, and also, with the Dementia Center. I guess what we also find is we have the tools, but they also have to change the workflow quite a ...

But can we quantify what is the cost of leaking my genome or the genome of a population? I mean, it’s difficult to quantify these things. We could put a price tag on these things to really make it clear, but even also for other personal information, I think the ...

And I think in particular also with AI, there are certain things we can expect that will be a return as societal benefits. But the error margin is still quite big, so to say, to quantify, but to be true on both sides, on the risk side as well as ...

And there are risks that we can roughly estimate. And at some point, there are societal decisions if you want to do this or not. Again, perfect privacy security you will not be able to deliver in absolute terms. So, that’s something I see more and more as a communication ...

And obviously, they have an argument in their own right. There are so many things they can do. They can help people prevent harm from happening. But at some point, I think there’s also an honest discussion to say there is benefits that we know, or we hope to get ...

But I’m not sure if fully knowledgeable or not, basically paying into that security, that the user security paradigm, but not a full privacy paradigm in a sense. That’s something we still have ongoing discussion. People are raising awareness. There are also obviously things you can do to compartmentalize data, ...

Exactly. This is obviously the problem, so the main thing that the clinicians are excited about, to have rare diseases that are normally not diagnosed, not being diagnosed based on genomic information, is kind of adverse to the privacy application. And it seems like that has been going down as ...

Obviously, the main argument, for example, for the genomic database is diagnosis of rare diseases. And that’s exactly what our strong privacy methods are not meant to protect. If you have rare groups…

Yeah. It’s also difficult to discuss. I’m partially involved in the German genome initiative. There’s a German genome archive that’s being built. There’s the larger European health data space and so on. That’s also in the discussion. For primary use, that’s all fine. It’s basically just having digital health records. ...

Because in the end, there could be this open model, but then maybe still industry would take it and monetize it. It also happens sometimes that they take some open source and then build something on top, but they don’t really give back to the community that actually has built ...

At a certain point, I would really like to see this idea of a completely democratic way of processing things. If you think people own the data and they own the compute also a significant amount. I was really fascinated by this to think about a completely decentral way. Then ...

Also, I think there will be more resilient infrastructures if we can use more decentralized computes. Maybe have an open-source backbone that can ingest knowledge graphs, neural networks and different types of information. Maybe some of them are trained with strong privacy guarantees, others maybe without. And have a modular ...

Also, in handhelds we have some supercomputers in the EU for example. There are also ideas how to train foundation models. I think more on a scientific scale, using high quality medical data. Maybe rather going for quality instead of scale, which I think has a higher value on its ...

We also try to partner with some companies. In Europe there’s Aleph Alpha, which is one of the larger companies that train larger models. We actually have an upcoming project with them on safety and alignment. It’s an issue to say how to operate in that space and do meaningful ...

Yeah, okay. I think also that brings back the question, so to say, how to operate as an academic in this space. Also typically, I pick my fights in the sense that I don’t bound to lose them. There’s obviously a certain scale in this. With the EU Commission, they ...

So, I’m a bit split myself. Maybe also I wouldn’t know how to be really actionable in the space to make a sensible way to constrain, also enforce it globally. I think this is really kind of a lost opportunity.

Yeah, to say the least. But then, if I may ask, and you also have ways, do you think we should be more capping these developments? Or like, there’s always, I would say capping or the opinion to cap the development would be more security, more obscurity than just, say, ...

I think that also falls a bit on our cyber security taxonomy we built on that LLM compute platform. Once you’ve been able to inject or even have persistence, like almost AI malware in that system, it affects the summarization that would be a very powerful and a lot of ...

Yeah, yeah. Yeah, I think it’s quite scary what central point these models sit right now in that information ecosystem. They have the mandate to really interpret or guide the understanding of information or selected information. So, there’s so much power if that really manifests in this way, and we ...

Ah, okay. Okay, I see. Point taken, yeah…

But I think, yeah… And I was a bit torn how much to worry about data poisoning, I think NSA is quite worried about it. It’s difficult to see how this can be done at scale, also sustainable, if you actually want to reach a certain end point as an ...

But again, so if we think there is a sane foundation model, we might be able to certify the fine-tuning process. Because once you are kind of already on a track, so to say, the impact the data has is much more limited as if you train from scratch. So, ...

So, I think the way we see this in the future is maybe, hopefully, some company provides us foundation models and they say, okay, they did their duty, they have curated, they have accountability. And that’s actually another interesting thing about liability questions between the foundation model provider and the ...

I think one of the things that we also think is very challenging is defending against poisoning. We apparently have some early research on training certifications. We know how to do inference certification, but certification… basically, showing robustness for training is very challenging and difficult for randomly initialized… well, it’s ...

And maybe for some domains, I think again you’re just moving away from language and rather having something more structured output. I think there’s also the US military firm that has laid out some visions how they want to use language more for military purposes and combat planning. While I ...

So, this is a way I think we might not be completely stopping injection or indirect prompt injection, which again we did quite a bit and also pioneered at the beginning of the year. But at least we can detect once something is interpreted as an instruction block instead of ...

Yeah. And also in a similar way, that’s something we just started on right now, is when we try to detect if they’re being prompted. So basically, we hypothesize, I think it’s something that’s really good - We don’t have any real evidence for this right now, but I think ...

So, I think also overall, I think it would be good if we have more of these meta properties, like if you think about language more like a brain, like a control center where we kind of think it’s not operating in this mode or in that mode, maybe it’s ...

We also looked at hallucination recently, so it’s basically, we can’t fully disclose it yet, but it’s basically more like a lie detector, so we believe that these models, when they start to hallucinate, they use kind of other parts of their brain kind of with a different process. So, ...

Yeah, yeah. And he’s thinking about tech, yeah. That showed how many hidden triggers are in these models. I think that’s still quite challenging.

Yeah, very fascinating, very advanced roadmap. Again, I think definitely for verification, again, there’s a lot of progress. Again, we also made on different norms and so on. I think for language, that’s obviously very challenging. Again, also the recent results on finding kind of post fixes, I think there ...

Okay, wow. I’ve never heard of this before. It’s very fascinating. Is it more like a re-task?