AI Engineer World's Fair 2025
Cognitive Shield Real Time Real Smart - Rachna Srivastava
Read the talk
Cognitive Shield: From Synthetic Identity to Graph-Based Fraud Investigation
A cloned voice can turn familiarity into an attack. Cognitive Shield connects regulatory workflows, specialized detectors, fraud graphs, and investigator tools to defend that trust.
From a talk by Rachna Srivastava
Before you start: Basic familiarity with databases, APIs, and machine-learning models is helpful; the article introduces the graph workflow and its query language.
When impersonation passes verification
Your manager calls. The voice has the familiar tone, urgency, and choice of words. The intranet is down, he says, and a client briefing cannot wait: send the confidential information to his personal email. Only after sending it do you discover that the caller was a voice clone. Rachna Srivastava opens with this scenario because the attacker succeeds by reproducing the cues an employee normally uses to establish trust.
The next example moves from conversation to identity verification. An AI-generated face appears during video KYC, blinks at the expected moment, smiles naturally, and clears identification. A verification process can become the entry point when its evidence is synthetic. These attacks do not necessarily break through a technical barrier; they satisfy the checks and enter as apparently legitimate users. Cognitive Shield is introduced as a defense against that combination of synthetic identity, convincing communication, and automated deception.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
Three ways to manufacture trust
Srivastava tells three stories that move from an urgent phone call to a prolonged relationship and then a fabricated investment ecosystem. In her first account, Anthony, a retired father in California, receives a call from someone sounding unmistakably like his son. The caller describes an accident involving an injured pregnant woman and says he needs bail. A second caller, posing as the son's lawyer, reinforces the emergency. Srivastava says Anthony wires $50,000, his entire retirement savings. She describes the voice as a clone made from his son's publicly available TikTok video; by the time the real son returns that evening, the money is gone. Familiarity establishes identity, and the supposed lawyer supplies a second layer of authority.
The second account concerns Lisa, a 45-year-old Ohio woman feeling isolated after the pandemic. An Instagram contact claims to be a famous Australian television star, calls her his soulmate, and promises marriage. Visa problems and financial difficulties explain why they never meet. Srivastava describes 18 months of daily messaging during which Lisa sends nearly $40,000. The face, she says, was AI-generated. She calls the scheme pig butchering: a relationship cultivated to extract money, with AI and cryptocurrency helping scammers conceal their tracks. Lisa reportedly described the experience in January 2025 to warn others. Here, repeated contact gradually substitutes for independent verification.
The third account follows Xavier, a 29-year-old accountant in Austin, who discovers Zipmax Pro in early 2025. Its credibility comes from an entire supporting environment: a polished website, enthusiastic YouTube testimonials, a white paper packed with AI and blockchain terminology, and an active Discord community. Weekly livestreams and AMAs feature synthetic avatars modeled on Silicon Valley influencers; a deepfake Elon Musk endorsement adds borrowed authority. The pitch promises up to 35% annual returns from AI-optimized DeFi investments.
Srivastava describes Xavier investing $60,000 of personal savings and his entire 401(k), without resolving whether those amounts overlap. The creators then dump their holdings in a rug pull, collapsing the coin's value. She says more than 5,000 people across the United States were defrauded. In this account, AI supports multiple parts of the operation: fake identity verification at exchanges, celebrity impersonation, plausible smart contracts, social bots, and synthetic influencers. The apparent corroboration comes from many surfaces, but those surfaces belong to the same manufactured story.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
Using AI to recognize engineered deception
Srivastava reports a 375% increase in AI-powered scams since 2023 and says 76% of synthetic identities bypass traditional fraud detection. The presentation supplies no population or measurement method for those percentages. She also cites $9.3 billion in cryptocurrency losses reported to IC3 for 2024 and describes a 66% annual increase. The cryptocurrency total is broader than AI-enabled fraud; it should not be read as an AI-fraud subtotal.
The engineering motivation is the combination of emotional manipulation and scale. An attacker can generate credible identities and communications while reproducing the operation across many targets. The defensive premise is that models capable of learning behavioral patterns can also be trained to recognize manipulation. Cognitive Shield applies that premise across data management, detection, and response, rather than treating a convincing message or face as sufficient evidence of legitimacy.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
A defense spanning operations, detection, and response
Cognitive Shield organizes financial fraud defense into three layers. The first holds the operational data and assists users before problems become cases. The second examines activity for fraud. The third gives investigators the information and workflow needed to respond.
| Layer | Responsibility | Main capabilities |
|---|---|---|
| Secure operations | Establish and manage trusted records | Users, licensing, examinations, cases, payments, AI guidance |
| Fraud detection | Identify suspicious activity and connections | Specialized detectors, user and transaction graphs |
| Investigation and response | Turn signals into accountable action | Search, dashboards, escalation, audit trails |
The detection layer is described as eight modules covering threats such as deepfakes, bots, phishing, synthetic identities, and cryptocurrency scams. Graph analysis adds relationships among users and transactions. The response layer combines those signals with human investigation, including trend analysis, automatic escalation, and compliance records. Detection is one stage in a workflow that must also preserve evidence and assign responsibility.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
AI assistance inside regulatory work
The foundation layer stores licensing applications, examinations, case records, and payments in a secure database. AI assistance is attached to the work users already perform. When someone submits a license application or renewal, the system checks for missing information, flags inconsistencies, and offers guidance while the form is being completed. During examinations, it reviews responses and documents for unusual patterns that deserve human attention.
Legal and billing assistance explains case outcomes, fines, and deadlines in ordinary language. A built-in assistant accepts natural-language questions and uploaded legal documents for summaries and insights. Role-specific dashboards then expose application status, compliance status, and payment workflows to regulators, licensers, and auditors. The intended benefit is continuity: a user can move from a record to an explanation and then to the next required action without leaving the operational context.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
Different detectors for different evidence
The detection layer uses specialized components because the evidence for a cloned voice differs from the evidence for coordinated blockchain activity. The module slide names Deepfake Hunter, Graph Intelligence, Pattern Evolution, Social Media Guardian, Communication Shield, Bot Detection, Blockchain Watchdog, and Payment Guardian. The spoken explanation groups capabilities by threat and model family rather than giving a separate implementation for every label.
| Detection task | Described technique | Evidence examined |
|---|---|---|
| Deepfakes | Generative adversarial network (GAN)-based systems | Manipulated media |
| Bots | Gradient boosting machine classifiers | Automated blockchain activity |
| Phishing | NLP plus WHOIS and other checks | Communication and domain information |
| Cryptocurrency scams | Graph neural networks (GNNs) | Transaction networks and anomalies |
The GAN reference identifies a model family without specifying the detector's training procedure or decision rule. For phishing, language analysis is combined with information about the domain; for cryptocurrency fraud, relationships among transactions become part of the evidence.
More broadly, deep learning analyzes images and audio for deepfakes and voice cloning. GNNs connect users, devices, and transactions to reveal possible fraud rings. NLP examines phishing, social engineering, and unusual communication patterns. Multimodal signal processing combines text, voice, and metadata so that an investigation can consider several kinds of evidence together. The presentation describes these capabilities, but gives no measured accuracy, false-positive rate, throughput, or end-to-end latency.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
From unstructured evidence to a queryable fraud graph
Fraud may involve a network of accounts, people, and devices rather than a single suspicious record. The graph workflow therefore begins with a data-construction problem: emails, PDFs, forms, and logs do not arrive as nodes and edges. Their entities and relationships must first be extracted and connected.
Step 1: Build and enrich the graph. CrewAI coordinates an agentic workflow using large language models to extract entities and relationships from text, PDFs, forms, emails, and logs. Internal Postgres records enrich that graph. Srivastava gives two examples of what models such as GNNs can then look for: accounts acting in sync and devices reused across multiple fake identities. The graph makes a shared device an explicit connection between accounts, rather than leaving an investigator to discover it across separate records.
Step 2: Persist the relationships. Neo4j stores the graph's nodes and edges. Step 3: Ask questions in natural language. An LLM translates an investigator's question into Cypher, the graph query language understood by Neo4j. Srivastava describes this as a Neo4j-based RAG system that surfaces patterns, anomalies, and entity linkages. Here, GraphRAG names the retrieval approach; the talk does not identify a particular GraphRAG package or version.
For a concrete illustration of the reused-device question, suppose accounts A101 and A102 both have a USED_DEVICE relationship to device D7. An investigator asks, “Which devices are shared by multiple accounts?” With illustrative Account, Device, and USED_DEVICE schema names, the corresponding query is:
cypher
MATCH (account:Account)-[:USED_DEVICE]->(device:Device)
WITH device, collect(DISTINCT account.id) AS account_ids
WHERE size(account_ids) > 1
RETURN device.id AS device_id, account_ids
ORDER BY device_id;
For those example records, the query would return D7 with A101 and A102. That is a relationship worth investigating, not proof that either account is fraudulent. The useful transition is from scattered account evidence to an explicit, queryable connection.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
Turning alerts into accountable action
The response layer begins with a unified fraud intelligence console. Investigators use natural-language search to access information in Postgres and Neo4j without remembering each database's query syntax. Live dashboards show fraud hotspots, changing tactics, and connections among suspected bad actors, bringing the evidence into one investigative view.
Escalation adds a decision about ownership. A combination of rules and LLM-based logic assesses the severity of an open case and routes it to an appropriate person or team. Role-based access controls who can act, while an audit trail records what happened. Investigations can then produce PDF or CSV reports for regulators, auditors, and internal teams. The operational chain is signal, assessment, routing, investigation, and a traceable record of the response.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
Walking through the operational application
The application walkthrough starts on a dashboard with recent searches, emerging threats, and recent alerts. The visible Recent Searches table includes result counts and risk-score bars. Navigation follows the same three-layer structure: user management, fraud and graph detection, then investigation, search, dashboards, and alerting.
The first group of screens covers administrative work:
- Users and cases: User activity, security settings, accounts, and contacts sit alongside case creation, AI case analysis, and case search.
- Examinations: Scheduled, in-progress, completed, and canceled examinations have management views, with risk assessment, risk history, and business rules. Timing, expenses, billing, analytics, and reporting accompany these workflows.
- Invoices: A summary dashboard separates draft, sent, paid, overdue, and canceled invoices. Available actions include creating an invoice, exporting it, and requesting AI analysis.
The repeated dashboard-first layout gives each workflow a summary before its individual records and actions.
Processing screens link organizations, perform calculations, and offer AI discrepancy detection. The payment portal exposes pending payments, payment history, and receipts. A multimodal assistant then adds voice input and output, web search, and the ability to browse and save user data for later search. These screens connect the earlier description of AI assistance to the records and statuses an operator actually handles.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
Monitoring media, payments, and online activity
The fraud screens organize evidence by its source and the type of investigation:
- Deepfakes: Image, video, and audio analysis appear alongside recent analyses, search, and threat intelligence.
- Payments: Views cover suspicious transactions, active cases, response time, trends by fraud type, and alert statistics, with AI payment analysis and detected patterns.
- Web and social media: Web fraud has real-time monitoring. Social views let an operator choose platforms and examine investment, phishing, and cryptocurrency scams.
- Cryptocurrency: Screens expose suspicious wallets, smart contracts, transaction flows, blockchain activity, financial impact by blockchain, and fraud trends.
- Phishing and bots: Phishing views show active campaigns, domain analysis, and targeted organizations. Bot views expose networks, behavior, and threat analytics.
The walkthrough demonstrates the monitoring surfaces available to an investigator; the displayed categories and charts are not an evaluation of detector performance.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
Graph construction and investigation tools
The knowledge graph builder connects to Neo4j and offers text-to-graph construction from user text, PDFs, and document files. A query generator accepts natural language and produces Cypher; a GraphRAG interface provides retrieval and insights. These are the application counterparts of the earlier build, persist, and query workflow.
Investigation and enforcement add general search, domain regulation monitoring, and search history. System analytics include AI insights about transactions and alerts, fraud patterns, geographic threat distribution, and risk-model performance. Alert monitoring filters by severity, status, and source, while retaining attack records and statistics and supporting active investigations. The walkthrough ends with APIs used by the frontend to extract and manage data, establishing the application's API-driven structure before the implementation stack is introduced.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
The implementation stack
The stack separates presentation, API handling, agent coordination, and storage:
| Component | Role in Cognitive Shield |
|---|---|
| Streamlit | Dashboard frontend |
| FastAPI | Incoming login activity, uploads, and other API data |
| CrewAI | Coordination of collaborating AI agents |
| Postgres | Operational data storage |
| Neo4j | Graph storage and analysis |
| GraphRAG and LangChain | Retrieval and agent functionality |
Srivastava presents this combination as the basis for scaling real-time detection. Operational records remain in Postgres while Neo4j supports relationship analysis; the graph complements the transactional data layer.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
Making fraud decisions observable and explainable
The implementation lessons begin with security: trust must be designed into the system from the start. Model specialization follows. Fraud changes quickly and spans different evidence types, so Srivastava recommends collaborating agents trained for particular tasks rather than relying on one model to recognize every kind of attack. Graphs add a way to inspect hidden connections alongside relational records.
For service design, she recommends an API-driven architecture and FastAPI microservices instead of a large monolith. Operationally, the system must monitor model behavior as well as uptime, including false positives and false negatives. Decisions need to be tracked and explainable so investigators can understand why the system acted. Privacy belongs in the initial design too; Srivastava describes the team's approach as encrypting everything and assuming nothing. A fraud alert earns trust through inspectable evidence and decisions, not simply through the presence of AI.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
Defending trust, and the teaching behind it
The closing returns to the full lifecycle: protect user data and assist people working with it; apply deep learning, graph AI, and LLMs to detection; then expose signals through response tools and compliance reporting. The graph recommendation is complementary: relational databases need graph support to capture networks of connections. Multi-agent LLMs are presented as a way to bring speed, clarity, and context to time-sensitive decisions.
Srivastava forecasts that by 2027, 90% of cyberattacks will be AI-driven and annual fraud losses will exceed $100 billion. These are forecasts offered to convey urgency, without a supporting methodology in the presentation. Her stated mission is prevention: intervene before fraud succeeds, and make defending trust a collective responsibility.
The final dedication explains the educational and ethical roots of that mission. Srivastava credits Jeremy Howard's classes and code at fast.ai with her deep-learning education, including the belief that AI should be open, ethical, and accessible. She names ULMFiT, the language-model fine-tuning work of Howard and Sebastian Ruder, as an influence on NLP. She connects Cognitive Shield to that teaching: practical model building joined to a responsibility for how the technology affects people.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
Resources
From the talk
Current documentation for coordinating specialized agents through Crews and managing workflows with Flows.
Guides and API documentation for building interactive Python applications and dashboards.
Tutorials and reference material for building Python HTTP APIs.
Jeremy Howard and Sebastian Ruder's original ULMFiT paper on transferring pretrained language models to text-classification tasks.
Further reading
Examples of graph retrieval, including natural-language questions translated into Cypher and answers grounded in returned records.
Jeremy Howard's free practical course covering model training, deployment, and applications across images, text, and tabular data.
Read the complete timestamped transcript
- 0:01
Hello, everyone. Thanks so much for joining me today. Let me start by asking you a very simple but profound question. What happen when the smartest tool we have ever built stop working for us and start working against us?
- 0:22
Let's just stop for a moment and think about it. Imagine getting a phone call, a voice sounds exactly like your manager, the same tone, the urgency, the choice of word, everything on the spot.
- 0:40
He says his intranet is down and ask you to urgently send all the confidential information to his personal email so that he can brief a client. It all seems legitimate until you later discover it was a deepfake scam.
- 1:00
You unknowingly sent company's sensitive information to a fraudster.
- 1:07
Or picture this, a face appear on your screen for a video KYC, blinks at the right time, smiles naturally, clears identification without a hitch. But here is the catch, it's not real.
- 1:23
It's AI-generated deepfake. We all know it already, so the issue is we are not dealing with old school fraud anymore. We are facing synthetic identities, deepfake onboarding, and AI-driven scams that look and feel more human than human
- 1:48
itself. These threats do not just break in, they get verified and walk through the front door completely undetected.
- 2:02
The issue is we are not just trying to detect fraud now, we are trying to detect intelligence.
- 2:11
And that's the real challenge, and it is exactly why we need to rethink everything we know about trust, identity, defense in the age of AI.
- 2:27
So how do we fight back? How do we stay ahead in the world where fraud does not just hide, it blends in?
- 2:43
This is where Cognitive Shields comes in. Today, I will show you how our cutting-edge solution leverages advanced AI and machine learning to spot and stop these invisible threats.
- 3:01
But before we dive in, let's start with some real stories.
- 3:11
Here are three real-life stories that highlight how AI-driven fraud is affecting people today.
- 3:21
The first story is a story of Anthony, and this story is about voice cloning scam. Let's, let's, let's listen to it. Anthony is a retired father, lives in California.
- 3:39
One afternoon, he got a phone call. The voice on the line undeniably his son's. Same accent, same little tone only a father would recognize. The son sounded panicked.
- 3:54
There has been a terrible accident. A pregnant [REDACTED:gender] was hurt, and he was at a police station and needed bail money immediately.
- 4:06
A moment later, another man called, and he claimed to be his son's lawyer, and he urged Anthony to wire $50,000 immediately or his sons would be taken to jail.
- 4:24
Anthony has never heard about deepfake, but he had heard about his son's voice, and he trusted it. He immediately wired 50,000, his entire retirement saving, later to know it wasn't his son.
- 4:41
It was a AI-generated voice clone created using publicly available TikTok video of his son.
- 4:50
This time-- Then by the time the real son came in the evening, the money was already gone.
- 5:00
Uh, let me-- Let's listen to second story. And this story is about Lisa, a [REDACTED:age] [REDACTED:gender] who lives in Ohio. She feels very isolated, more isolated i- after pandemic.
- 5:19
One night, a man messaged her on her Instagram claiming to be a famous [REDACTED:origin] TV star. He called her, her his soulmate and promised to marry her,
- 5:35
and this continues for over eighteen months. They message every day but never met, always blaming visa and money issues. He asked for help,
- 5:49
and Lisa sent nearly 40,000 of her savings over time.
- 5:56
But the man wasn't real. His face was made by AI, and it-- this was a scam These scams actually has a name, and this is called pig butchering, and are growing very fast.
- 6:13
Scammer in this case build fake relationship to steal money, often using AI and crypto to hide their track.
- 6:27
And Lisa reported it in January twenty twenty-five, and she shared her story to warn others, and she feels if it is too perfect to be true, it might be a scam.
- 6:41
Let's talk about third and the last story, and this is the story of Xavier. Xavier is a [REDACTED:age]- [REDACTED:age] accountant from Austin, Texas. He's really smart,
- 6:58
financially savvy, and always on a look for a real big tech opportunity. He thought he found one in early twenty twenty-five, and that's when he discovered Zipmax Pro, a flashy new cryptocurrency project that seems to check all the right boxes.
- 7:21
It had everything: a very slick professional-looking website, dozen of growing investor testimonials on YouTube, white paper filled with current cutting-edge AI and blockchain jargons,
- 7:39
an active Discord channel run by charismatic developers, weekly live stream and AMAs featuring synthetic avatar modeled after real Silicon Valley influencers, and even deepfake video of Elon Musk appearing to endorse the project.
- 8:03
And the pitch was very simple. A AI-driven platform that optimize DeFi investment and promising up to thirty-five percent annual return.
- 8:18
Xavier, like thousands of other, believed he was getting in very early to this next big thing. He invested sixty thousand of his personal savings and entire 401K.
- 8:35
Then without warning, it all disappeared one day. The creator of Zip-Zipmax Pro executed a classic rug pull, dumping their holdings, crashing the coin value to plummet.
- 8:54
Xavier lost everything, but he wasn't alone. Over five thousand people across the US were defrauded by the same scam. And the worst part? Every element of the scam was powered by AI.
- 9:12
Fake ID, uh, ID verification to pass the crypto exchange check, deepfake celebrity e-endorsements, AI-written smart contract that looked legitimate, social media bot and synthetic influencers to build hype.
- 9:32
This wasn't just your isolated incident. AI-powered scam have surged three hundred and seventy-five percent since twenty twenty-three. Seventy-six percent of synthetic identities now bypass traditional fraud detection.
- 9:51
Americans reported record nine point three billion dollar in losses from cryp-crypto-related crime, and this is sixty-six percent just, uh, jump in just one year.
- 10:06
These are not phishing emails of the past. They are intelligent, emotionally engineered attack built by machine and designed to exploit trust at scale.
- 10:23
As AI continues to evolve, so do the tools of fraudsters.
- 10:31
So it's imperative that we develop a robust defense to protect individual from such sophisticated scam.
- 10:47
So now let's be honest. AI can be used to deceive, to defraud, to exploit. But here is a good news. AI can also be used to detect, to defend, and protect,
- 11:05
and that's the paradox we are living in. It is the one we have to embrace. The same AI that is used to commit fraud can be trained to stop fraud.
- 11:19
The same model designed to manipulate behavior can be retrained to re-recognize it and shut it down. The same technology that is shaking our foundation of trust, it can be u-reused to rebuild trust and is stronger than ever.
- 11:40
And in this presentation, I'm going to show you exactly how.
- 11:51
So now that we have laid out the challenges and the high stake of AI-driven fraud, it's time to talk about the solution. Let me introduce you to Cognitive Shield, the next-generation platform designed specifically to protect financial, financial ecosystem against this sophisticated threat.
- 12:17
Cognitive Shield is designed as a simple three-layer defense system. Each layer is tackling a different part of the fraud problem, from prevention of real-time detection all the way to intelligence response.
- 12:38
The layer one is all about building a strong foundation. This is where we securely manage user data, licensing data, examination cases, and payment data.
- 12:54
But it's, it's, but it's more than just a storage layer. We use AI to guide user through the complex processes and flag potential risk before they become real problem.
- 13:11
It is safe, it is smart, and it is user-friendly. Next come the layer two, and layer two is about real-time fraud detection engine. This is where AI really shines.
- 13:29
Our system uses eight advanced detection module constantly s-scanning for threat for deep-deepfake, bot, phishing attacks, synthetic identities, crypto scam, and more.
- 13:48
We also use graph technology to map user and transactional behavior, helping to spot the fraud rings that traditional system usually misses.
- 14:02
Finally, lay-layer three brings all the things together by combining AI and human insights for a smarter response. Investigator get powerful console with AI-powered search and live dashboard and trend analysis.
- 14:24
Cases are automatically escalated when needed, and the system keep complete audit trail of compliance. This means teams can move faster, stay organized, and meet regulatory demand effortlessly.
- 14:42
In short, Cognitive Shield brings together smart, secure data management, real-time AI detection, and intelligent human-led responses, all in one platform, so that the organization can stay ahead of fraud every step of way.
- 15:12
Let's start with layer one, the foundation of Cognitive Shield, our secure user and regulatory management layer.
- 15:24
This is where all the core operations happen, the licensing application, examination, case tracking, payment, et cetera. It is built on secure, reliable database so that your data stays protected and organized.
- 15:46
But what re-really set this layer apart is that how deeply AI is integrated into every step of the process. For example, when a user submits a license application or renew AI...
- 16:05
or a renewal application, AI instantly check for missing information, flag inconsistencies, and offer real-time guidance. It is like having an expert watching over every form and making the processes smoother and error-free.
- 16:27
When agencies launches exam, AI reviewer response, response and document to spot unusual pattern, potential red flags, helping teams le- focus only where human attention is really needed.
- 16:46
On the legal and billing side, AI breaks down the complex cases, outcomes, clarifies fines and deadlines, answers any user questions in plain and everyday language. No more digging into legal, legal,
- 17:04
l-legal jargons anymore. It also has a smart built-in assistant that user can use to ask, ask question naturally, upload legal document, get quick summaries, insights all in one place.
- 17:23
And finally, everything is presented in a role-specific dashboard. Whether you are a regulator, a licenser, auditor, you get a clear view of the application, compliance status, and payment workflow.
- 17:39
So layer, layer one isn't about managing data, it's about turning the complex processes into seamless, intelligent experience.
- 17:59
Now let's delve into layer two, the core of Cognitive Shield system. This layer is engineered to identify and mitigate sophisticated fraud attempts in real time, leveraging state-of-the-art AI technologies.
- 18:20
Our system comprises of eight specialized detection module, each tailored to identify a specific type of fraudulent activity.
- 18:32
Deepfake detection, for example, utilizes generative adversarial network GAN-based system to identify and manu-manipul-manipulate media.
- 18:45
Bot detection, for example, employs machine learning classifier g-gradient boosting machine to discern automated bot activities in blockchain transaction. Phishing detection analyzes the communication pattern using natural language processing to detect AI-generated phishing attempts, uses WHOIS and
- 19:10
other techniques. Crypto scam, uh, generation applies graph neural network to analyze transaction network, identify anomalies patterns, uh, in the fraudulent activities.
- 19:28
To power our fraud detection engine, we use some of the most advanced AI technologies that are built to understand and respond in real-time. For example, we use deep learning that help us analyze images, audio to detect things like deepfake, voice cloning quickly and accurately.
- 19:53
Graph neural network tracks connections between user devices transaction, spotting hidden fraud rings and a suspicious pattern that we miss otherwise. Natural language processing reads and interpret text to detect the phishing atta-attempts, social en-engineering tricks, unusual language and communication, et
- 20:18
cetera. And we h-finally have a multimodal signal processing that pulls all together in the text, voice, metadata. We get a full picture of the thread and the... And we can resmo-respond smartly.
- 20:40
Let's talk about how we use graph-powered AI to find hidden fraud.
- 20:50
Fraud is not always one bad actor. It is often network of connected people, account, and devices so that we have to, we have to focus on how things are connected, not just what happened.
- 21:09
And here is how we do it in three simple step. Step one is building the graph. One of the hardest part of graph-based fraud detection is turning the unstructured data into a structured graphical for knowledge base.
- 21:32
And we solve this using agentic workflow that we built using CrewAI and large language model.
- 21:42
The... Here we can, uh, we can extract the entities and relationship from simple text, PDF document, forms, emails, logs, and et cetera.
- 22:00
We also enrich these graphs with information from the internal Postgres database, uh, that help us tie everything together to create the complete real-time view of the fraud landscape.
- 22:18
Then we run models like GNN to find the hidden connection, things like group of accounts that are acting in, in sync, devices that, that has been reused across the multiple fake identities, and so on.
- 22:34
In short, we have automated the most difficult part of the graph intelligence, that is creating the knowledge graph, and we turned it into a powerful tool for uncovering fraud rings that would otherwise stay hidden.
- 22:53
Step two is Neo4j is used as a gra-graph persistent mechanism. We store all the graphs and, uh, nodes and relationship into a Neo4j open graph database.
- 23:12
And step three is asking graph smart questions, and this we do by using Neo4j-based, uh, retrieval-augmented generation, or RAG, system that integrated with large language model to convert...
- 23:31
to take the user queries in natural language and then translate that into a Cypher, uh, language that is understood by Neo4j and, and, and that allows input...
- 23:48
that allows us to generate, uh, generate user, um, user queries in, uh, seamlessly by taking in, in the natural language. This setup enables real-time exploitation of graph relationship, supporting high performance fraud detection by surfacing patterns,
- 24:13
anomalies, and entities, linkages that traditional relational system often overlook.
- 24:27
So let's talk about layer three, and this is where everything comes together. As fraud become more advanced, our response need to be smarter, faster, and more coordinated.
- 24:43
This layer is all about that, turning alerts into action and action into result.
- 24:52
So first step is the unified fraud intelligence console. Think of this as a mission control. It brings the insights from across the system into one place. And the best part is it uses AI-powered natural language search to investigate so that user do not need to remember
- 25:17
complex queries to get the insights from the data, whether it is Postgres database or Neo4j database.
- 25:27
Second step, uh, second, uh, step is real-time dashboard and adaptive analytics. This dashboard give us the live view of what is happening, fraud hotspots, trending, uh, tactics, big actors, uh, are connected.
- 25:48
It is the-- It's where you, you will see the visual intelligence that helps terms-- that helps teams move faster and make more-- most informed decisions by looking into these dashboard, uh, in real time.
- 26:09
Then we have a case escalation system or alert, and, and also alerting system. And what it does, it, it, it, it spots the serious threat. It does not just flag it, it acts on it also.
- 26:26
AI automatically analyzes how severe the open case is, route it to the right person or the team. It uses the mix of rule-based and LLM-based logic to decide what needs more attention and when.
- 26:44
And everything is logged with role-based access and full audit trail.
- 26:50
Finally, we have compliance-ready reporting. All investigators are... investigations are fully traceable. Reports can be exported in PDF or in CSV form.
- 27:07
And this helps regulators, auditors, and internal tea- team. Everything is clear, well document, and easy to share.
- 27:19
So in short, layer three is where insights become action. It helps you detect, respond, escalate, and report all in real time and all with complete transparency.
- 27:39
Before we get into the architecture of the system, let's, let's stop here and let's see how... Now you have the background, let's see how the real system looks like.
- 27:55
I will give you a walkthrough of... This is the Cognitive Shield ec- uh, application. Here you see the Cognitive Shield. This is the main dashboard where you see what are the rec-recent searches, what are the emerging thread, what are the rec-- what are the recent alerts.
- 28:18
And, and, and as we mentioned before, this is a three-layer system. Layer one is about user management. Layer two is about fraud detection and, and also about graph fraud detection.
- 28:36
And layer three is about investigations and search and dashboarding, alerting, and so on.
- 28:46
So we start with user management. This is where the user activities are recorded, security setting is done, user account management, user contact management.
- 29:01
Everything re-related to the user is, is, is performed in this flow. Then we have the case management. In the case management, you can create a case, you can analyze the case using AI, you can search for cases, and so on.
- 29:21
Then we have examination management. Here we-- any cases, all this, you can look at the scheduled exam, all in-progress exam, completed exam, canceled exam. There is a...
- 29:36
You can create a start, uh, examination on any cases, you can manage existing exam, you can perform ricks-- risk assessment, risk history, business rules. You can also view the
- 29:53
timing of the system, you can view the expense report, billing thing, analysis, uh, all kind of analytics and reporting. Then we have invoice management system. Every system, as you see, all flows starts with a dashboard where you see the summary of what, what you have done.
- 30:15
The-- Here you have, um, invoices, invoices that are draft, sent, paid, overdue, canceled. You can create a new, new invoice, you can export the invoice, you can get the AI analysis of the invoice
- 30:34
Then we have a processing flow. Here you can link different organization. You can form... You can perform the calculation. You can get the disc- discrepancy detection using AI. We have payment portal.
- 30:51
In this payment portal, you can see the pending payment, payment history, different kind of receipt and so on. Then we have a chat, um, chat assistant. This is a multimodal chat assistant that is made based on voice output, voice input, web search, different mod- modality of search.
- 31:15
Here you can browse and, and save user data that you want to search on, and so on.
- 31:24
Then we have a different kind of fraud detection system. You can perform a deepfake fraud detection, and in this case, you can perform a deepfake fraud on images, videos, audios, and, and you can po-- get the re- uh, recent analysis.
- 31:47
You can search by different, uh, deepfake, uh, fraud. There is a threat intelligence and so on. Then we have a payment fraud, what kind of suspicious transaction observed, what kind of active cases, what kind of a response time.
- 32:06
You can, you can see, you can see the fraud trend over time, fraud by different types, alert statistics, also the payment analysis using AI, fraud pattern observed, different case management.
- 32:24
Then we have a web fraud. These, these are the real-time fraud monitoring. Then we have social media fraud. Here you can choose the different social media that from where you...
- 32:38
Different fraud type, the investment, uh, scam, phishing scam, cryp- and crypto scam and so on observed on different fra-- uh, different social media. Then we have cryptocurrency, currency fraud.
- 32:55
This is, uh, you can, you can get the suspicious crypto wallet, smart contract, transactional flow. Sus-- You can watch the suspicious activity in blockchain, financial impact by different blockchain cryptocurrency schemes, fraud trend and so on.
- 33:16
Then we have phishing detection. Uh, uh, what are the different, uh, active phishing campaign going on? Domain analysis. What are the targeted or- organizations? And then we have bot detection.
- 33:34
What are the different bot network, bot behavior, threat analytics
- 33:40
and, and so on. Similar, uh, we also have a graph-based fraud detection, knowledge graph builder. Here you connect to the Neo4j. We have text to graph.
- 33:56
It helps you create the knowledge graph based on the user text.
- 34:01
You can create the graph based on, on the PDF document or, um, or, or document file. And, and then we have a query generator that can generate a Cypher query based on your user natural language, and we have a graph RAG to extract the query and get the insights.
- 34:25
Similarly, we have, uh, advance, uh, we have a, in- investigation and enforcement. This is where user can perform the searches, general searches, domain regulation monitoring, and you can also have a search history.
- 34:43
You have analytics dashboard of the whole system. Um, and also you can get the AI insights, uh, from also the transaction and alerting system, fraud pattern, geographic distribution of the threats, risk, risk model performance.
- 35:05
We have alert monitoring. Uh, here you can choose the severi- severity of the attack, the status of attack, and the sources where you want to g- filter the attacks and, and, and get the dashboard.
- 35:21
Um, it also saves your attacks, uh, and, and statistics. And you can perform the active investigations on different, uh, frauds and so on.
- 35:35
So this is basically a very high level what we have, uh, uh, what, what we have done. And we also have different, uh... Here are the APIs that we have designed to, uh...
- 35:51
It's a API-driven architecture where APIs are, uh, are designed and used to extract the data and manage, um, uh, and, and, and extract the data and, uh, and manage, uh, from the front end.
- 36:10
So coming back to our system. So let's, let's learn about how we have actually built this, uh, uh, this,
- 36:23
uh, this system. Cognitive Shield is just not another fraud tool. It's a real smart AI-enabled, AI-supported Tool that handles the modern fraud from deepfake to crypto scam to social engineering, and so on.
- 36:45
The front end we have built using Streamlit to create easy-to-use real-time dashboard.
- 36:54
API layer is built using FastAPI that handles all the incoming data, whether it is the login transaction, document upload, and so on.
- 37:06
AI layer is powered by, uh, CrewAI, that is the brain of the system. It runs multiple AI agents that work together, um, and, and, and get the insights. The data layer is done in Postgres database.
- 37:25
Neo4j is using, uh, for graph analysis. And then we have GraphRAG and LangChain for AI agents.
- 37:38
So the whole system is designed to build and, and scale a real, real-time detection of the different frauds. This is AI fraud defense, which is a smart, fast, and built for today's threats.
- 38:03
Let's, let's, let's talk about what we have really learned after building this, this system.
- 38:15
We learned that if you build a system, we have to start
- 38:22
with security from day one. Trust is not something you patch in later. It has to be ingrained into the system. Next, do not rely on single AI model to catch all kind of fraud,
- 38:40
or all kind of fraud. Fraud is a messy, fast-changing, so one size is not going to fit all kind of fraud problem.
- 38:52
So we have to use multiple specialized agent, each one trained from specific tasks and let them collaborate, um, in a agentic manner. Then always think in graph, not just rows and, and, and columns of a relational database.
- 39:13
Graph help us detect the hidden connections which we usually miss in the relational database.
- 39:24
And, and instead of building a giant monolithic system, think of microservices, and we used FastAPI, API-driven architecture that can be easily scaled.
- 39:39
And we have to keep observability in mind. We have to monitor the AI models like, um, uh, we have to monitor the uptime, we have to monitor the false positive, false negative.
- 39:56
We have to track everything, and we have to make sure that every decision is explainable, and that is how we earn trust. Finally, build the privacy from the start.
- 40:12
We encrypted everything, we assumed nothing. And with these principle, we made Cognitive Shield a resilient, transparent, and built for real world of financial fraud.
- 40:33
As we close today's presentation, let's try to summarize w- a- and bring everything together.
- 40:45
We have learned that Cognitive Shield is built by three-step system. Step one is about data trust, data storage, and everything start by keeping the privacy of the user, user security, and also using AI to help the user
- 41:11
m- manage and sa- and, and, and store the data. Step two is a real-time fraud detection. This is the brain in action powered by deep learning, graph AI, secure LLM, that do not just react to fraud, they anticipate it and, and, and, and work on it.
- 41:37
Step three is intelligence hub for responses and compliance. This is where the insights become action. We surface the signals, the alerts, the visual dashboard, and compliance reporting.
- 41:56
Here is what the key takeaway is that AI is not an optional tool, it's the future for f- future of fraud defense. Graph over tables because it's, uh, essential, because relationship revealed by relational da- database
- 42:21
has to be, uh, also supported by graph to capture the network of connections.
- 42:29
Multi-agent LLMs give us the speed, clarity, and context of the world where millisecond matter.
- 42:39
Why do we have to act now? Because if we wait, by twenty twenty-seven, ninety percent of cyberattack will be AI-driven. Fraud losses will surpass hundred billion dollar per year.
- 43:01
So we cannot wait because our mission is very clear. We have to stop fraud before it start. This is not just a platform. It is just a technical...
- 43:20
It is a movement, and we want you to be part of it.
- 43:26
Let's defend trust, let's protect the future, and let's do it all together.
- 43:38
As we wrap up this presentation, I want to take a moment to dedicate this presentation to someone who has been a true inspiration in my journey, Jeremy Howard, the visionary behind fast.ai.
- 43:56
He did not just teach me how to build models. Everything I know about deep learning, I learned from his classes, his code, his belief that AI should be open, ethical, and accessible to all.
- 44:13
His works changed the field of AI. U-
- 44:18
U-ULMFiT redefined how we approach NLP. But more important, his teaching changed people, including myself.
- 44:30
This platform, this mission, this entire journey is buil- built on what you gave us all. Thank you so much, Jer- Jeremy, for your vision, generosity, courage, and continue to inspire us all.
- 44:48
Thank you so much, everybody. Thanks.