1
00:00:01,520 --> 00:00:03,200
Now we have some audio.

2
00:00:11,660 --> 00:00:14,320
Okay, so everyone somewhat speak?

3
00:00:22,950 --> 00:00:24,170
Okay, now try again.

4
00:00:24,170 --> 00:00:25,910
Yeah, now we have audio.

5
00:00:26,150 --> 00:00:27,490
Hello, good.

6
00:00:27,490 --> 00:00:28,810
Can you hear me, Sven?

7
00:00:29,310 --> 00:00:30,350
I can hear you.

8
00:00:30,350 --> 00:00:30,990
Hey, Irem.

9
00:00:31,150 --> 00:00:35,530
Oh my gosh, it was just a simple Windows reboot fixes everything.

10
00:00:36,910 --> 00:00:39,010
Hey, I unfortunately, I actually have a meeting right now.

11
00:00:39,010 --> 00:00:41,130
So I'm going to drop and join again.

12
00:00:41,130 --> 00:00:44,510
What time do I need to be on for speaker time?

13
00:00:45,010 --> 00:00:46,510
In 30 minutes.

14
00:00:47,510 --> 00:00:50,630
But only in Discord or also in Zoom?

15
00:00:51,110 --> 00:00:52,330
Only in Discord.

16
00:00:53,310 --> 00:00:54,190
Okay.

17
00:00:56,070 --> 00:01:00,810
Yep, so we've got people in the Slack chat or in the Twitch chat saying they can hear us.

18
00:01:00,810 --> 00:01:01,950
So I think we're good to go.

19
00:01:02,330 --> 00:01:03,110
Sweet.

20
00:01:04,070 --> 00:01:05,850
Well, hi, everyone.

21
00:01:05,850 --> 00:01:07,310
Sorry about the audio issues.

22
00:01:07,310 --> 00:01:10,430
That seems to be the start of every stream is figuring out the audio.

23
00:01:11,790 --> 00:01:14,910
The only people I've seen get it right are like Critical Role.

24
00:01:17,730 --> 00:01:20,290
They pay a lot of people to get it right.

25
00:01:20,490 --> 00:01:21,170
Yeah.

26
00:01:21,910 --> 00:01:26,910
Welcome to AI Village at DEF CON 28 safe mode.

27
00:01:28,010 --> 00:01:29,990
We're all doing this from home.

28
00:01:32,750 --> 00:01:36,930
I hope that this can be as fulfilling to you guys as it is to us.

29
00:01:38,690 --> 00:01:53,730
And we just want to start off the village with some like general questions about the state of the field as it is right now at the end, halfway through 2020.

30
00:01:54,430 --> 00:01:59,710
So Jag has got a bunch of questions prepared and the rest of us are going to try to answer them.

31
00:02:01,090 --> 00:02:02,010
Okay.

32
00:02:02,890 --> 00:02:03,910
Welcome, everyone.

33
00:02:03,910 --> 00:02:04,370
Thanks.

34
00:02:04,370 --> 00:02:05,890
Thank you for being here.

35
00:02:05,890 --> 00:02:09,510
The first question that I have listed is...

36
00:02:09,510 --> 00:02:13,430
Let's just knock this one out of the way real first.

37
00:02:13,670 --> 00:02:17,610
Facial recognition is a security concern for us.

38
00:02:18,110 --> 00:02:20,490
In the ML field, of course.

39
00:02:21,090 --> 00:02:24,070
And before you answer, please introduce yourself.

40
00:02:24,750 --> 00:02:25,230
Yeah.

41
00:02:25,230 --> 00:02:27,950
We should probably do a who is who.

42
00:02:29,530 --> 00:02:31,990
Sven, do you want to kick us off?

43
00:02:33,050 --> 00:02:33,990
Sure.

44
00:02:33,990 --> 00:02:35,210
So I'm Sven.

45
00:02:36,110 --> 00:02:39,850
I am a senior data scientist at Elastic.

46
00:02:39,850 --> 00:02:46,870
Before that, I was a topologist who accidentally got into machine learning and security.

47
00:02:47,850 --> 00:02:52,370
And I kind of helped run the AI village.

48
00:02:55,010 --> 00:02:57,030
John, do you want to go next?

49
00:02:57,230 --> 00:02:58,070
Yeah, sure.

50
00:02:58,070 --> 00:02:58,790
Hey, everyone.

51
00:02:58,790 --> 00:02:59,770
DeltaZero here.

52
00:02:59,770 --> 00:03:02,770
I do data science for intrusion detection.

53
00:03:02,770 --> 00:03:07,770
Yeah, I've been in the field for maybe, I don't know, four years now.

54
00:03:07,770 --> 00:03:09,890
But pretty awesome.

55
00:03:09,890 --> 00:03:11,110
Glad to be here.

56
00:03:14,110 --> 00:03:15,270
Rich?

57
00:03:16,170 --> 00:03:17,910
Hi, I'm Rich Huerang.

58
00:03:17,970 --> 00:03:21,690
I'm a director of data science research at Sophos.

59
00:03:21,690 --> 00:03:30,250
I've been working at the intersection of machine learning, security, and privacy for probably about 10 years now.

60
00:03:30,250 --> 00:03:32,250
Got my PhD from UCSB.

61
00:03:32,250 --> 00:03:39,050
Spent some time with the US Army Research Laboratory, and I've been at Invencion Sophos ever since.

62
00:03:44,460 --> 00:03:45,600
Yaga?

63
00:03:46,040 --> 00:03:47,740
Hi, I'm Yaga.

64
00:03:47,740 --> 00:03:52,280
I am a professor at a small university in Virginia.

65
00:03:52,520 --> 00:04:02,080
I've got about 25 years of experience in security, but relatively new to machine learning.

66
00:04:02,080 --> 00:04:10,180
My research is focused on securing machine learning, and I like playing video games too.

67
00:04:10,180 --> 00:04:13,940
So there's something interesting about it.

68
00:04:14,200 --> 00:04:14,930
Anita?

69
00:04:15,640 --> 00:04:17,080
Hi, I'm Anita.

70
00:04:17,080 --> 00:04:19,360
I'm a research scientist at University of Illinois.

71
00:04:19,360 --> 00:04:21,500
Started life as a cryptographer.

72
00:04:21,500 --> 00:04:24,440
Been in security for almost 30 years.

73
00:04:28,200 --> 00:04:31,120
Okay, and Will's the last guy.

74
00:04:32,360 --> 00:04:34,400
Certainly not least.

75
00:04:34,400 --> 00:04:35,720
Yeah.

76
00:04:36,560 --> 00:04:39,280
Sorry, my morning's just starting.

77
00:04:39,380 --> 00:04:53,260
Will, I am a network operator, and I guess attack machine learning models and use AI for offensive purposes.

78
00:04:53,260 --> 00:04:56,600
Phishing, pathfinding, and stuff.

79
00:04:58,360 --> 00:04:59,760
Yeah, Will's being modest.

80
00:04:59,760 --> 00:05:05,860
He actually has the first CVE ever assigned against a machine learning system.

81
00:05:05,860 --> 00:05:11,240
If you attend my lab later, there'll be another one.

82
00:05:13,900 --> 00:05:16,960
I think that's a challenge for everyone.

83
00:05:18,540 --> 00:05:22,000
Can you get one file before Will drops number two?

84
00:05:25,560 --> 00:05:28,460
Okay, thank you everyone for the introductions.

85
00:05:28,460 --> 00:05:30,820
Sorry, I should have thought about that.

86
00:05:31,120 --> 00:05:35,740
Please be sure to ask any questions over in the Discord server.

87
00:05:35,740 --> 00:05:38,320
There is a talks channel.

88
00:05:40,800 --> 00:05:43,420
Yes, there's a channel for talks.

89
00:05:43,420 --> 00:05:48,000
You can ask in there or in the general, and we'll try to catch it.

90
00:05:48,100 --> 00:05:50,420
So back to the first question.

91
00:05:50,620 --> 00:05:56,100
This was one that was both easy and hard to throw out there.

92
00:05:56,100 --> 00:06:06,100
But is facial recognition a security concern when we're talking about privacy?

93
00:06:06,800 --> 00:06:13,500
For sure we know about, but in the general machine learning terms, is facial recognition a security issue?

94
00:06:14,880 --> 00:06:24,320
So I think just to make the point in our village, one of the things we're trying to do is expand from just thinking of this as a technical kind of algorithm problem.

95
00:06:24,320 --> 00:06:33,040
If you look at the broader scope of facial recognition, there are issues not just with security, with data sets, with data integrity, with these kind of choices.

96
00:06:33,440 --> 00:06:36,480
So I think my answer would be it is a security issue.

97
00:06:36,480 --> 00:06:37,540
It's a machine learning issue.

98
00:06:37,540 --> 00:06:38,200
It's a data issue.

99
00:06:38,200 --> 00:06:39,480
It's a human issue.

100
00:06:40,280 --> 00:06:45,000
And for us, we need to think about all those things as technology people.

101
00:06:47,180 --> 00:07:00,480
Yeah, and just to add to that, a lot of the issues around facial recognition are less to do with the technology and more to do with the processes that that technology is embedded in.

102
00:07:00,480 --> 00:07:06,220
So if you have a facial recognition system that works, you have issues around privacy, right?

103
00:07:06,220 --> 00:07:07,840
Who gets access to that system?

104
00:07:07,840 --> 00:07:10,560
Who gets to know who was seen where on which camera?

105
00:07:10,700 --> 00:07:13,740
And then when it doesn't work, you have bias issues that sneak in.

106
00:07:13,740 --> 00:07:16,360
So how do you control for false positives, right?

107
00:07:16,360 --> 00:07:24,920
Someone gets reported as being, you know, facially recognized as a bank robber or something when it's just like an average person.

108
00:07:24,920 --> 00:07:28,000
And this actually extends beyond issues of just facial recognition.

109
00:07:28,000 --> 00:07:30,880
Just computer vision in general has problems like this.

110
00:07:30,880 --> 00:07:44,180
There was a story recently about a license plate recognition system, which led to someone being pulled over and detained, you know, face down on the side of the road for hours before they figured out that it was the wrong license plate number, the wrong make of car,

111
00:07:44,180 --> 00:07:47,000
the wrong model year, et cetera, et cetera, et cetera.

112
00:07:47,000 --> 00:07:57,940
So yeah, it's definitely a case of not only does the ML work, but do you have the right controls around the ML to make it actually usable?

113
00:07:57,940 --> 00:08:04,020
And have you, you know, assessed what happens when it actually fails so that it can fail gracefully without hurting people?

114
00:08:05,560 --> 00:08:06,840
Anyone else?

115
00:08:07,320 --> 00:08:20,800
I think the last thing, not to dominate this, but the last thing to throw in is I feel like in our village, part of our job is to also translate all this technobabble sometimes to policy speak and to real world speak.

116
00:08:20,800 --> 00:08:22,800
And that could be very challenging.

117
00:08:22,800 --> 00:08:24,820
We know the technical parts.

118
00:08:24,820 --> 00:08:29,000
What ends up on the other end, we need to bridge that gap.

119
00:08:29,680 --> 00:08:35,920
I think that's important to understand that security isn't just the technical side.

120
00:08:35,920 --> 00:08:39,220
There's a human side to it too, and that extends to policy.

121
00:08:39,220 --> 00:08:41,140
So definitely something to think about.

122
00:08:41,140 --> 00:08:41,520
Thank you.

123
00:08:42,200 --> 00:08:48,740
Staying along the same lines, one of the things that I wanted to ask about is the FOX program.

124
00:08:48,740 --> 00:08:50,620
Have you heard about it?

125
00:08:50,620 --> 00:09:06,440
And how does it affect our ability for the end user to take back some of that control over their data?

126
00:09:08,560 --> 00:09:16,380
It's technically, again, this is, it's the gap between technical aspects of it and implementation and social aspects of it.

127
00:09:16,380 --> 00:09:18,700
Technically, it's a brilliant idea.

128
00:09:18,700 --> 00:09:21,760
And, you know, it does what it says on the tin.

129
00:09:21,760 --> 00:09:39,360
In practice, there are so many ways that people get registered into facial recognition systems from, you know, collecting ID cards to photos that they uploaded before FOX was a big thing to photos that other people take of them and maybe tag them in later,

130
00:09:39,360 --> 00:09:51,260
that you really can't just find a quick technical band-aid for security problems that are really a combination of social and technical problems.

131
00:09:51,260 --> 00:09:55,240
The root cause here isn't like, oh, we just need better technology to fix this.

132
00:09:55,240 --> 00:10:01,880
The root cause is society and sort of laws and norms haven't kept up with the technology.

133
00:10:01,880 --> 00:10:05,200
And that's the angle that we need to address it from.

134
00:10:05,200 --> 00:10:13,820
Technical band-aids are only ever going to be available to people that know about them, know how to apply them, and can get over that barrier to entry.

135
00:10:13,920 --> 00:10:17,360
Really, we need to be thinking broader about impact to society as a whole.

136
00:10:18,160 --> 00:10:24,980
It makes me think a little bit of this field of, you know, usable privacy and, you know, privacy by design.

137
00:10:24,980 --> 00:10:34,540
See, that's analogous here because people don't understand that long-term impact of having a photo op.

138
00:10:34,540 --> 00:10:36,880
So, enabling people to use this tool is great.

139
00:10:36,880 --> 00:10:42,460
I think the average person isn't going to even think about it because it doesn't affect their day-to-day life.

140
00:10:42,460 --> 00:10:51,280
So, again, I think the issue is, how do you express to them the long-term potential damage of having their pictures out there?

141
00:10:52,140 --> 00:10:57,460
Okay, we're going to move into a different arena.

142
00:10:58,320 --> 00:11:10,360
What do you say the latest advances that your typical security team could use in terms of machine learning?

143
00:11:11,380 --> 00:11:17,880
You know, a lot of vendors are out there saying that this is going to be the panacea for them to be able to fix things.

144
00:11:17,880 --> 00:11:24,600
Some of the actual products that will help them or techniques that will help them.

145
00:11:26,440 --> 00:11:35,540
I just want to take this opportunity to plug the panel that we have coming up on Saturday on whether or not ML and InfoSec lives up to the hype.

146
00:11:35,540 --> 00:11:39,640
So, we're going to be diving, hopefully, pretty deep into those questions.

147
00:11:39,640 --> 00:11:42,680
But I'll kick it over to someone else since I've been talking a lot.

148
00:11:47,220 --> 00:11:52,500
I really don't know what the boots on the ground could be using.

149
00:11:53,320 --> 00:11:57,860
But there are some promising things coming down the pipe from researchers.

150
00:11:59,560 --> 00:12:00,680
But I...

151
00:12:02,540 --> 00:12:04,660
So, I'll jump in real quick.

152
00:12:04,660 --> 00:12:05,960
Sorry to dominate again.

153
00:12:05,960 --> 00:12:08,600
And I'll let Will speak because he's more an operator.

154
00:12:08,720 --> 00:12:15,520
For me, federated learning, federated and privacy-preserving machine learning is very important for a bunch of reasons.

155
00:12:16,020 --> 00:12:22,740
Not the least of which is being able to learn across edge devices that are in multiple disparate places and being able to do it more efficiently.

156
00:12:22,760 --> 00:12:27,840
And being able to use new types of data because there's privacy-preserving ways to do it.

157
00:12:27,840 --> 00:12:33,320
So, I think I see federated learning as something that's promising.

158
00:12:34,780 --> 00:12:40,040
Yeah, I'd say from a product standpoint, it's just like the simple stuff.

159
00:12:40,040 --> 00:12:49,780
So, you know, on a network, clients will still miss password spraying internally.

160
00:12:50,020 --> 00:12:54,520
And that's just something that shouldn't be happening with the logs that are available.

161
00:12:54,520 --> 00:13:06,540
So, I think in terms of just instant response and stuff on networks, it's the simple stuff that is going to give you the most bang for the buck.

162
00:13:09,120 --> 00:13:14,740
Obviously, there's a lot of competition in the machine learning space, or it would seem.

163
00:13:17,440 --> 00:13:28,160
And half of me, at least 40% of me, thinks in two years, we're going to be moving on from machine learning as a solution in networks.

164
00:13:28,160 --> 00:13:32,700
And we'll probably replace it with like zero trust or something like that.

165
00:13:34,080 --> 00:13:39,120
But there's also the other 10% that thinks like it will always have a place.

166
00:13:40,020 --> 00:14:01,100
But just like with the facial recognition stuff and the bias, if we don't put it out in a way that's useful, and in a way that people can understand, the minute it breaks, they're likely to just throw it out the window and say it doesn't work.

167
00:14:02,700 --> 00:14:07,180
Even though, you know, it is a perfectly viable solution.

168
00:14:07,840 --> 00:14:09,820
But yeah, I'd say simple stuff.

169
00:14:10,320 --> 00:14:10,800
Yeah .

170
00:14:10,900 --> 00:14:11,580
Okay.

171
00:14:11,820 --> 00:14:20,180
To me, that's the more important side of the question is like, practitioners on the ground, we don't need any new math or anything new interesting.

172
00:14:20,180 --> 00:14:30,100
But there's some basics that they can get their hands on that will probably help them out when they have to deal with a deluge of alerts from some sim that they have to deal with.

173
00:14:30,100 --> 00:14:32,680
A little bit of clustering could go a long way in that situation.

174
00:14:34,020 --> 00:14:36,440
Yeah, I think that's perfect.

175
00:14:36,660 --> 00:14:42,880
That's perfect for what I was going to say is, I didn't mean to say products, I probably wrote that down wrong.

176
00:14:42,880 --> 00:14:51,220
But like, what can we tell our audience here that maybe practitioners that they can do on their own?

177
00:14:51,220 --> 00:14:59,700
So I think something like our workshops, if you take a look at them, they'll be able to help you see that you may not need to go get these expensive products.

178
00:14:59,700 --> 00:15:02,000
There's some simple things you can do.

179
00:15:03,680 --> 00:15:04,520
Yeah.

180
00:15:04,620 --> 00:15:21,760
Yeah, and I just add to that, but from my own experience as someone who's used ML to tackle a lot of security problems, very often you don't even need like the big complicated deep neural networks or gradient boosted decision trees or pick your flavor of the day.

181
00:15:21,760 --> 00:15:35,120
Very often, it's enough to have a good idea of the problem you're trying to solve and a good set of representative data and then simple methods like, you know, linear logistic regression will often be enough to tackle it for you.

182
00:15:35,120 --> 00:15:43,020
So, you know, you don't need to think that you've got to have tons of like Amazon EC2 credits to run a big beefy GPU machine.

183
00:15:43,020 --> 00:15:49,220
A lot of times you can get really like 80% solutions, really good solutions just on your laptop.

184
00:15:50,300 --> 00:15:51,820
Okay.

185
00:15:54,940 --> 00:16:04,360
For most security to be able to defend yourself, you have to be able to identify the issue or identify the attack.

186
00:16:04,500 --> 00:16:11,960
We discuss, you know, adversarial attacks quite a bit in the academic realm.

187
00:16:12,080 --> 00:16:19,280
How could someone tell that they're seeing an adversarial attack in practice today?

188
00:16:22,210 --> 00:16:23,410
You mean on the AI?

189
00:16:23,410 --> 00:16:25,050
I'm throwing out some hard ones.

190
00:16:25,070 --> 00:16:26,870
You mean on the AI portion?

191
00:16:29,390 --> 00:16:33,410
Well, how could you just notice an attack?

192
00:16:33,410 --> 00:16:40,330
Because to defend against something, you typically have to be able to define what that attack looks like, right?

193
00:16:40,930 --> 00:16:42,910
At least to some degree.

194
00:16:43,210 --> 00:16:44,970
Can we do that today?

195
00:16:47,350 --> 00:16:52,570
It's kind of too bad Hiram's not here because I feel like he'd have a lot to say on this topic.

196
00:16:55,410 --> 00:16:56,770
Let's hear it.

197
00:16:57,510 --> 00:17:08,170
So for the traditional adversarial attacks, we basically are trying to modify an image or something slightly to bypass the machine learning system.

198
00:17:08,170 --> 00:17:11,730
That doesn't really work with security because our data is much more structured.

199
00:17:11,730 --> 00:17:21,770
You can't like do a gradient descent on a binary and then hope it still compiles or runs because you're going to get byte codes that are just wrong.

200
00:17:22,970 --> 00:17:30,770
So I don't think like adversarial attacks as academics that you read up in a big year paper are going to really apply.

201
00:17:30,770 --> 00:17:34,870
There are some modifications to that that might apply that might be very helpful.

202
00:17:35,890 --> 00:17:43,430
But what we do see already and have been seeing for like a decade is people just trying a bunch of stuff and then they get past it.

203
00:17:43,430 --> 00:17:52,590
And the more they get informed they are about how the machine learning model works, the more effective and more like gradient descent it is.

204
00:17:52,750 --> 00:17:55,090
You know, like the more effective they are.

205
00:17:55,090 --> 00:18:10,010
Like for like the spam filters from back in 2001 when people were packing Wikipedia articles at the bottom of their spam messages to bypass the naive Bayesian classifiers, they understood that it wasn't a naive Bayesian classifier.

206
00:18:10,010 --> 00:18:12,450
They understood that they needed to pack the thing.

207
00:18:12,450 --> 00:18:14,510
And then they did that.

208
00:18:15,070 --> 00:18:21,570
And that's going to happen with next-gen AV products too.

209
00:18:21,710 --> 00:18:24,050
It may already be happening.

210
00:18:25,730 --> 00:18:31,130
I mean, that was what we saw in the silence bypass was effectively a stuffing attack.

211
00:18:31,130 --> 00:18:31,830
Yeah.

212
00:18:32,590 --> 00:18:38,550
That was researchers being nice to us and telling us about the problem that's happening.

213
00:18:41,790 --> 00:18:49,210
So this one is more directed at Will, but definitely want everyone's opinion.

214
00:18:49,350 --> 00:18:57,710
And it gets back to something we talked about in a journal club, which for those of you that might not have seen it, we may be replaying it during the weekend.

215
00:18:59,230 --> 00:19:07,470
Will received a CVE for the vulnerability he discovered.

216
00:19:07,470 --> 00:19:17,110
But do we need actual CVEs specifically for machine learning or should we keep them more general?

217
00:19:19,090 --> 00:19:25,990
So I guess first I'd like to say it was our, so Nick Landers and I did it.

218
00:19:26,550 --> 00:19:28,370
I just talk about it more so.

219
00:19:30,690 --> 00:19:34,550
So the CVE system is designed to communicate risk.

220
00:19:35,310 --> 00:19:43,330
And I think anywhere that risk is present, then a CVE is appropriate.

221
00:19:46,150 --> 00:19:48,070
You know, I just, I submitted it.

222
00:19:48,070 --> 00:19:51,510
So I'm not the one that gets to say whether or not it's a CVE.

223
00:19:52,270 --> 00:19:57,290
So I guess that the question would be for the NIST.

224
00:19:57,810 --> 00:20:04,410
And I know they've come out with a paper that kind of highlights machine learning attacks or there's a taxonomy.

225
00:20:04,410 --> 00:20:07,710
It's like 15 taxonomies right now.

226
00:20:08,350 --> 00:20:19,210
But yeah, I think in any way there's risk that is at least measurable, a CVE would be appropriate or any standardized score.

227
00:20:19,950 --> 00:20:21,310
I know there's operators like...

228
00:20:22,130 --> 00:20:32,270
And I'm sorry, I don't mean should it be a CVE, but more should there be a class just for machine learning, you know, because they break it down.

229
00:20:32,710 --> 00:20:34,430
Yeah, yeah, I think so.

230
00:20:34,750 --> 00:20:36,970
It's fundamentally different.

231
00:20:39,030 --> 00:20:47,150
You know, so for example, like with a traditional exploit, you know, there's like a patch and then you can push it out.

232
00:20:47,150 --> 00:20:57,930
But with, for example, like with Proofpoint's model, there's some residual, there's some like lingering theft going on.

233
00:20:58,030 --> 00:21:05,210
So once you have that copycat model, you're never going to get 100% of their model.

234
00:21:05,210 --> 00:21:13,250
But for some, there's some decay into the future, but you'll have some portion of that model.

235
00:21:13,250 --> 00:21:20,910
Your copycat model will be right, you know, up to some future time until they've retrained enough.

236
00:21:20,910 --> 00:21:34,690
But in their response, you know, unless they do things to fix it or prevent, you know, people from stealing outputs, then you can always create a new model.

237
00:21:35,730 --> 00:21:38,550
So I think that piece is important.

238
00:21:38,550 --> 00:21:48,390
But yeah, it's a little, it's fundamentally different beast than than like an exploit.

239
00:21:48,430 --> 00:21:55,470
Yeah, I don't know, you guys probably have a better idea of like, how you're supposed to patch a machine learning model or you take it out.

240
00:21:55,470 --> 00:21:56,550
I don't know.

241
00:21:57,510 --> 00:22:00,250
Long and expensive retraining process.

242
00:22:01,130 --> 00:22:13,550
Do you guys agree, though, that it's good to have that separate machine learning kind of category to highlight the fact that this is a vulnerability, a specific type of vulnerability?

243
00:22:15,270 --> 00:22:19,210
Yeah, I think most, so there are some exceptions.

244
00:22:19,210 --> 00:22:27,130
And, you know, again, I'm going to sort of like promote the Journal Club on the Summoning Demons paper later this weekend.

245
00:22:27,130 --> 00:22:34,410
But most machine learning exploits don't translate into exploits as we usually think of them in InfoSec.

246
00:22:34,410 --> 00:22:42,310
They are much more either model stealing or model bypass, or maybe like a denial of service type thing.

247
00:22:42,350 --> 00:22:59,430
So in my mind, keep in mind, I'm coming at this from the ML side of things and much less from the InfoSec side, I do think it makes a lot of sense to have separate categories that reflect the different kinds of risks that we currently think of ML models as being exposed to.

248
00:22:59,870 --> 00:23:00,790
Okay.

249
00:23:01,530 --> 00:23:04,690
So that's kind of all the questions I had.

250
00:23:04,690 --> 00:23:09,990
The next was, I was going to turn it back over to Sven to kind of give you an overview of the weekend.

251
00:23:10,050 --> 00:23:12,510
And thanks for being here, everyone.

252
00:23:12,510 --> 00:23:14,250
And thank you for your questions.

253
00:23:14,510 --> 00:23:15,670
Or answers.

254
00:23:16,350 --> 00:23:17,190
Yeah, cool.

255
00:23:17,190 --> 00:23:18,870
I'm really looking forward to the talks.

256
00:23:18,870 --> 00:23:20,530
This is going to be a great DEF CON.

257
00:23:22,030 --> 00:23:22,950
Cool.

258
00:23:23,510 --> 00:23:24,310
I'm out.

259
00:23:26,130 --> 00:23:27,310
Later, folks.

260
00:23:27,790 --> 00:23:28,770
Have fun.

261
00:23:29,150 --> 00:23:37,790
So about this weekend, the way we're structuring it is everyone, all the talks are recorded already and on my desktop.

262
00:23:37,790 --> 00:23:39,570
So the speakers won't be talking live.

263
00:23:39,570 --> 00:23:44,830
The reason why we're doing that is so that the speakers can focus on answering your questions in Discord.

264
00:23:45,290 --> 00:23:50,630
And so during the talk, speakers will be in the Discord and hopefully afterwards.

265
00:23:50,690 --> 00:23:56,450
So any questions you have about the thing, you can just ask it in the Discord channel, and we'll answer it.

266
00:23:56,590 --> 00:24:02,710
The speaker will answer it, or maybe someone else who's knowledgeable on the subject will help try to answer your question.

267
00:24:05,090 --> 00:24:12,250
So we're going to, in a few minutes, launch into the first one, which is we've got Zoltan here.

268
00:24:16,010 --> 00:24:20,390
Zahak, who's in Hyrum.

269
00:24:20,570 --> 00:24:24,330
They'll be going over to the Discord to answer any questions.

270
00:24:25,830 --> 00:24:29,090
And then, yeah, then we've got Eriks and a few others.

271
00:24:29,270 --> 00:24:34,670
Oh, Sarah, do you want to introduce yourself, too?

272
00:24:36,710 --> 00:24:38,150
Oh, god.

273
00:24:38,990 --> 00:24:44,770
SJTurk, ethics chair, so I guess the buck stops here.

274
00:24:46,530 --> 00:24:50,050
I guess data nerd who's working on disinformation.

275
00:24:57,600 --> 00:25:02,100
I think that's it for the intro stuff.

276
00:25:02,100 --> 00:25:03,320
Yeah, that's it.

277
00:25:03,580 --> 00:25:07,120
We were trying to leave some time to make sure the transition to Hyrum.

278
00:25:07,650 --> 00:25:12,080
Yeah, I've got that all ready to hit play.

279
00:25:12,620 --> 00:25:13,880
Okay, yeah.

280
00:25:13,880 --> 00:25:14,860
Oh, workshops.

281
00:25:14,860 --> 00:25:19,360
Yeah, so there's a few workshops.

282
00:25:20,630 --> 00:25:27,550
They're mostly focused on sort of bypasses and interesting techniques on...

283
00:25:28,270 --> 00:25:31,990
The hard part for us is text data.

284
00:25:32,630 --> 00:25:39,110
So, GtKondike, Gavin Kondike, well, has a lovely workshop on

285
00:25:42,990 --> 00:25:45,090
spam builders.

286
00:25:45,430 --> 00:25:54,750
And we have... Will here is talking about a new, basically, CVE2.

287
00:25:57,590 --> 00:25:59,650
Model stealing stuff.

288
00:26:02,930 --> 00:26:08,010
And the way those work are they'll be streamed on Twitch live.

289
00:26:09,950 --> 00:26:11,670
They're not recorded.

290
00:26:11,670 --> 00:26:25,170
And then there'll be a few people who are TAing who will help the workshop presenter help relay questions from Discord over to the workshop presenter and help resolve any minor issues you guys might have.

291
00:26:26,330 --> 00:26:31,270
There are Jupyter notebooks and stuff posted on the website.

292
00:26:33,070 --> 00:26:35,890
So, hopefully this all works out.

293
00:26:35,890 --> 00:26:41,250
It's a pretty normal machine learning workshop structure.

294
00:26:41,570 --> 00:26:48,830
Just online versus in person so that you can't have someone spy over your shoulder to tell you your typo is.

295
00:26:52,030 --> 00:26:58,050
Well, with that, let's start Hyrum's...

296
00:27:02,410 --> 00:27:03,230
Okay.

297
00:27:03,850 --> 00:27:05,850
I'm gonna go ahead and drop off.

298
00:27:05,870 --> 00:27:06,690
Hi, everyone.

299
00:27:06,690 --> 00:27:08,170
Have a great DevCon.

300
00:27:08,290 --> 00:27:08,670
We'll do.

301
00:27:08,730 --> 00:27:10,330
Have fun.

302
00:27:10,910 --> 00:27:11,330
Awesome.

303
00:27:11,330 --> 00:27:12,190
Thanks all.