Why Your Agent Disagrees With Itself (And What To Do About It)

Talk transcript

1. 0:03

   Hello. This session is about why do your AI agents disagree with itself, and what to do about it. And this is Die Huang Lin, and you can call me Diane.

2. 0:19

   A little bit about my background. My journey with AGI started from my PhD at Imperial College London, where I was working on continual learning. Later, I worked with Professor Josh Tenenbaum at MIT on one-shot learning, meaning learning from one single examples.

3. 0:42

   Afterwards, I was lucky that Alexa was launching. I was the first three applied scientists on the question answering team at Alexa.

4. 0:53

   Later, attracted by a, a startup working on AGI at Silicon Valley called Vicarious. So today, Vicarious is part of the Google DeepMind. There, I got to work on the exciting frontier research on zero-shot transfer learning.

5. 1:13

   After working on AGI for a few years, I decided to pivot to the applied world at Zscaler, which is cybersecurity company.

6. 1:25

   There, I got to apply a variety of different machine learning model to address the cybersecurity challenge.

7. 1:34

   There, for five years, uh, I decide to co-found my own company because the pinpoint I have seen at Zscaler.

8. 1:44

   So Culminate is building AI agent to auto triage your security alerts

9. 1:50

   and which make your SOC more efficient. Uh, we are super proud that Culminate has been acquired by Datadog earlier this year. So now I'm part of the Datadog and leading the development of self-evolve agent.

10. 2:14

    So today, I'm going to share with you the problem you're probably seeing in your day-to-day building AI agent, the inconsistency.

11. 2:24

    And then we'll discuss about where this inconsistency come from in order to figure out the solutions.

12. 2:33

    And we will discuss a few trade-off among the different solutions, and then eventually we'll show you the experimental results to show how feasible they are.

13. 2:46

    You probably see this. Same model, same input, but different output. Here, I don't mean the wording different, I mean semantically different output.

14. 3:01

    You might be thinking that's the stochastic nature of LLM.

15. 3:07

    Hold on to that thought. Let's look at a few concrete examples.

16. 3:13

    So here, imagine you're giving a task for sentiment analysis, where we are supposed to label each review of a hotel either positive or negative.

17. 3:26

    This is typical NLP task, and today's LLM is really good at this.

18. 3:33

    However, there's one problem. When you pipe this input to the same LLM model,

19. 3:42

    occasionally, you will see different verdict coming out of it when you run multiple times.

20. 3:49

    That means a single evaluation run didn't tell you the whole story. You need to repeat your evaluation multiple times in order to get a holistic picture

21. 4:05

    by the average over the different runs results.

22. 4:10

    And this sounds like a technical inconvenience, but the reality is, it's way more problematic than just inconvenience. Let me show you an example in a different domain in cybersecurity.

23. 4:26

    Imagine you're a security analyst, where your day-to-day job is triage the security alerts and decide whether it's malicious, that you need to take certain actions to stop the attack, or it's false alarm, meaning it's actually benign, which you could ignore.

24. 4:47

    So here, example alert you got is there's a failed login attempt to Gmail account detected from suspicious IP.

25. 4:58

    And if we give such similar tasks to this one to AI agent and run it different times,

26. 5:06

    you will see sometimes it stay consistently benign, sometimes it stay consistently suspicious across different runs. However, there are cases where it flip-flop between benign, suspicious.

27. 5:24

    Now, your customer will have a difficulty using such product because they will wonder which one should I trust?

28. 5:34

    So the inconsistency is causing a trust issue in your product.

29. 5:42

    Imagine if you were in a POC bake-off, one vendor gave the consistent verdict all the time, while the other

30. 5:55

    vendor have this flip-flop verdict. You can imagine which one will win the deal.

31. 6:04

    Now, I'm pretty sure you want to solve this problem

32. 6:12

    First, we ha- we have to figure out where the inconsistency come from.

33. 6:21

    The good news is the data points tend to flip-flop, actually concentrate around

34. 6:29

    the decision boundary, the so-called gray zone. Let me illustrate with the earlier example. Here, in the sentiment analysis, we have two reviews. The first one, actually, no matter how many times you run through the LLM model, it will always give you the positive label.

35. 6:54

    In this case, it's pretty obvious it's... the review is super positive.

36. 7:00

    However, the second case is the one tend to flip.

37. 7:05

    If we look closer, it's kind of on the boundary. Sometimes this certain word is kind of, uh, relative positive, but sometimes it's a little bit negative.

38. 7:20

    In this case, you will find that even human experts will have a disagreement on these cases. In fact, there's no right or wrong answer. It really depends on particular company's policy and their preference.

39. 7:38

    For hotel thinking that the... such a review is not something I can do to improve the memorial kind of experience, [laughs] memorable experience, then that mean not to label as negative because there's nothing I can do.

40. 7:55

    But some hotel might care about it and want to label them as negative so they can improve. So that comes down

41. 8:04

    your preference. Let's look the other cybersecurity example.

42. 8:11

    Here is another case on the boundary, and why it's in the boundary is here there's a few attempts.

43. 8:22

    Indeed, there's attacker knocking on the door, but

44. 8:28

    attacker might not get in yet. So for enterprise customers who always have attacker knocking on the door, while if they haven't get in in environment, they don't want to worry about it, otherwise they'll be flooded by this type of alerts.

45. 8:45

    There's nothing they need to do because they are blocked outside already.

46. 8:52

    However, if attacker did manage to guess the correct password and pass MFA and they manage getting the environment, then it become very seriously and you need to take certain actions.

47. 9:04

    So almost similarly at the beginning behavior, but very different outcome and different response needed

48. 9:14

    depends on whether it's truly attack or attacker is still outside. So here,

49. 9:23

    whether we label them malicious or benign depends on company preference, whether they wanted to be notified about such a situation.

50. 9:33

    So again, this is an example where it depends on your preference

51. 9:41

    and additional information to disambiguate between the two different scenarios.

52. 9:50

    So from these two very different domains, you will see that

53. 9:55

    actually the data points tend to flip-flop are the one close to the decision boundary, where it need your clarity to disambiguate which side it should really belongs to.

54. 10:14

    So these data points are where human experts tend to make a mistake, and the traditional machine learning classifier will also struggle with. So in other words, it's not your AI agent's fault.

55. 10:31

    Your ag- AI agent simply point out the ambiguity that already exist.

56. 10:38

    So now we know where the root cause or the inconsistent is. The next step is identify where exactly they are, who are they, and fix them.

57. 10:59

    Surprisingly and not surprised, the solution to identify the gray zone actually exists already in machine learning, and it's called active learning.

58. 11:13

    So the idea of active learning is you have a lot of data point to be labeled. Imagine you have in your initial model and you put it in production, maybe in the monitor mode,

59. 11:29

    and you wanted to check the quality, but you don't have bandwidth to check all of them. Otherwise, it lose the point of having agent to do the work.

60. 11:39

    But you still want to identify where the model didn't do well.

61. 11:46

    And the active learning is to find a way to select the data points where tend to make a mistake,

62. 11:56

    and that way tells you where to pull your attention.

63. 12:03

    So let's go over the traditional, uh, machine learning models, active learning pipeline, and see how it's different in the case of the new LLM or AI agent error.

64. 12:16

    So first, you train your initial model, and then you make predictions on the unlabeled data set. It could be the production online data.

65. 12:29

    And then from there, you see there's certain cases where the model wasn't sure because the probability is close to point five. And those data points are the high informational one that your model is going to learn the most.

66. 12:46

    The uncertainty is a type of a signal to tell you where the model tend to make the mistake.

67. 12:53

    Another popular type of way to figure out the problematic one is query by committee, meaning that it, by a few different models or even the same model multiple times, and then you identify the disagreement, and that's where the model tend to make the mistake as well.

68. 13:13

    And that's where you need human clarification on the label, so the model can learn it from.

69. 13:23

    The... after you surface these problematic data points and for human to take a second look to make sure the label is actually correct or do it, does it need additional information to disam-ambiguate those cases, meaning adding new features.

70. 13:42

    And then you can add those label data set or potentially additional features to the next round of training. Then you retrain the model and proceed, uh, continue the cycle.

71. 13:54

    So then you can see in this particular active learning cycle, you spend very little, uh, amount, or at least another way, it's very efficient way to identify the problematic data points and spend your attention on those point where your model tend to learn the most.

72. 14:18

    So that's the traditional one. The good news is the LM way is not very different.

73. 14:27

    There's a major two part which we need some refinement. One is on this selection strategy, the other part is about retraining.

74. 14:38

    On the selection strategy one, um, here we suggest you use the one about identify disagreement. At least from what we have tried so far, the uncertainty score from LM is not very reliable.

75. 14:55

    It's kind of, uh, the LM model doesn't know what it doesn't know. So when it's very confident, it doesn't mean that it was to-- it w- is correct. So that, however, the, the disagreement from different runs or from different models actually give you a more reliable signal where the model actually not sure about its verdict, and it

76. 15:19

    need human guidance. And then after you identify this group or the, uh, disagreement and n-need attention, you label them and provide the feedback like what you did before.

77. 15:37

    Then afterwards, you might be thinking, "Oh, time to retrain the model." Yes and no. Yes, one option is retrain the model, but fine-tuning model is expensive. Here we are proposing a more lighter weight solution, easier to iterate.

78. 16:01

    It's about augment your agent with semantic and episodic memory.

79. 16:21

    Let's use the previous example to illustrate what I mean here. Um, as we talk about, in this case, they tend to flip. It's mainly missing the information

80. 16:33

    about y- particular company policy or preference. Here we can add it to the, um, the, the knowledge base. If this customer complain about something outside the hotel's control, then classify as positive because you don't want to pay attention to this.

81. 17:00

    And then in the cybersecurity example, something similar, you can put in, in that the password spray, meaning that the attacker trying to guess your password and try diff- with different times, even fail and continuously.

82. 17:16

    So if without successful login, then that should be benign. But in contrast, if it succeed with final login, then that should be malicious. So here you actually identify the additional information to help disambiguate the two and then label them separately.

83. 17:36

    And that's a clarity that help your model to learn, also help your human experts to label more consistently.

84. 17:48

    So this type of domain knowledge sharper your decision boundary and also help the human beings. Uh, this type of knowledge is like factual knowledge, is part of actually belong to your semantic memory.

85. 18:02

    And this is in contrast with the episodic memory. Episodic memory is in the case where

86. 18:09

    you haven't got around to distill the reasoning behind the earlier case, why it should be on malicious or the benign side. Instead, you said that I have seen these similar cases before, and it was labeled as benign, and let me leverage those past similar cases, and they made the decision accordingly.

87. 18:33

    And the advantage of the, this episodic memory way is, it's relative automatically. It has less human intervention. I mean, the human intervention was done in the past already. When's it-- During-- When you're doing a job online, um, you can reference them, at least your AI agent can reference them automatically and can making decisions without waiting for you

88. 18:57

    to distill the reasoning and putting in the semantic knowledge. So the idea is that the-- identify a similar case to the one under examination and then leverage their past decision as a reference.

89. 19:13

    And then imagine there's a new case which is kind of in the middle, doesn't belong to any past group, and that's the one you still need human attention. And this is also, um, where episodic memory resolve recurring case

90. 19:31

    automatically. And this particularly useful in the case of cybersecurity alerts because a lot of noise, especially those false positive noise, are the one keep recurring, and that's the one are the low-hanging fruit you can automate away.

91. 19:48

    And with that human review, which is a precious attention, the bandwidth you have, now you can concentrate on those where episodic memory fail to address. And this is also how

92. 20:03

    we chose between semantic memory and episodic memory. The two are actually not contradicting. In fact, they are complementary. Basically, you use episodic memory to address those recurring situations automatically.

93. 20:18

    And then for what's remain, still re-flipping after the reference from the past or no reference to be able to use, then you pass on to human review. And then human review distill the domain knowledge and put it in the semantic memory to be used next time.

94. 20:38

    So here we talk about a solution actually brings three benefits. First,

95. 20:45

    we identify this data point near the decision boundary and use the domain knowledge in semantic memory and this past similar case in the episodic memory. We're able to improve the incon-- the consistency significantly.

96. 21:04

    So now you have a more trustworthy AI agent for your user to use. And two other by-product of this solution is you have a very efficient quality control.

97. 21:19

    You don't need to check every agent output, but instead, a subset of them which

98. 21:28

    your algorithm from active learning think is potentially problematic, and you check them, either provide additional information or clarify the label, and your model will learn from there.

99. 21:44

    So most importantly, your labeling effort is very small but high return.

100. 21:56

     Last but not least, now you are gathering your customer feedback along this way. You not only have a trustworthy, consistent model and high efficacy one, you also have one adapt to your customer environment.

101. 22:12

     I'm pretty sure your customer will love your product if you, your AI agent listen to them and adapt to them. So here are some experiment results from, uh, real data points.

102. 22:26

     So here we collect, uh, ninety-three alerts, cybersecurity alerts, and then we run them three times.

103. 22:35

     If without the solution we are proposing here, a quarter of them will flip-flop the verdict.

104. 22:43

     In contrast, after applying our solution or using episodic memory, about fifteen of percent of them become consistent. However, there's still ten percent of them remaining inconsistent.

105. 22:59

     They still flip, sometimes because there's no reference, similar cases in past to be ref-- used. Sometimes even there's a reference to be used, they still disagree after the second thought.

106. 23:15

     But not a problem. The episodic memory do the automatic knockdown of the inconsistency for fifteen percent, the remaining ten percent, human review and provide the additional knowledge to disambiguate those tricky cases.

107. 23:34

     After that, you also adapt to the customer environment that you want to learn.

108. 23:46

     So the three takeaways that I hope you have after this talk is, number one, inconsistency isn't usually your model problem. Stop blaming your model, but instead focus your energy on label issue and potentially insufficient information and help your AI agent with this

109. 24:11

     additional clarity. Second, the model disagreement isn't a bug, but a feature.

110. 24:22

     Treat each disagreement as a opportunity for your model to learn.

111. 24:29

     Third, fine-tuning isn't your only option. Arm your agent with semantic and episodic memory.

112. 24:40

     I hope you enjoy seeing your model keep improving and adapting to your customer environment.

113. 24:50

     Last but not least, I want to thanks to my colleagues and wonderful friends at Datadog. Special thanks to Zhichun, Santhosh, Anna Chu, and Stefan, Sai, and Matty to give me a lot of enjoyable discussions and helped me to clarify some of, um, the concept.

114. 25:14

     And also thank you for everyone in the BIDS Security Analyst team to make this journey enjoyable.

115. 25:22

     And thank you for listening. Hope you're enjoying training your model and having it improving.

116. 25:31

     Thank you. Bye.