# Evolve Within Bounds: Secure, Self-Improving Agents for On-Prem AI

## Abstract

Key takeaways Learn how to leverage open models as a core-strategic choice: For defense, public sector, and regulated industries, an open model enables ownership, self-hosting, air-gapped edge deployment, and the ability to further tune model weights for performance and control. Explore what makes self-improving systems essential and how they mitigate “deploy and forget” for compound AI: Without continuous adaptation, agents degrade as models, tools, and retrieval quality shift. Find out how the NVIDIA NeMo™ Gym–Haystack Agent integration delivers continuous self-improvement, optimizing agent behavior against real-world performance signals. Discover how the NVIDIA OpenShell™ runtime (now further bolstered by the NVIDIA Open Agent Safety Platform) enforces governed, sandboxed execution, so agents can adapt without exceeding the boundaries your organization has defined.

## AI Summary

_No AI summary available._

## Transcript

**[00:00:05 – 00:00:09]** Our next session is Evolve Within Bounds, Secure, Self-Improving

**[00:00:09 – 00:00:12]** Agents for On-Prem AI.

**[00:00:12 – 00:00:17]** And here who will be joining us is Malte Pietsch, co-founder

**[00:00:17 – 00:00:23]** and CTO at Deepset, Julian Riesch, Engineering Manager

**[00:00:23 – 00:00:29]** at Deepset, and Oleg Sudakov, AI Solutions Architect at NVIDIA.

**[00:00:29 – 00:00:34]** Please join and welcome Malte, Julian, and Oleg.

**[00:00:39 – 00:00:40]** Yeah, good morning, everyone.

**[00:00:40 – 00:00:43]** Welcome to our session.

**[00:00:43 – 00:00:46]** I'm deeply convinced that self-improving AI will be

**[00:00:46 – 00:00:52]** one of the big next step changes that we will see in AI, and

**[00:00:52 – 00:00:57]** I think many out there think that this is primarily a tool

**[00:00:57 – 00:01:02]** to enable agents to even solve more complex tasks in the future,

**[00:01:02 – 00:01:05]** to really just lift performance.

**[00:01:05 – 00:01:08]** But I think that's only one part where we can use it.

**[00:01:08 – 00:01:12]** I think it can also be super useful for reducing costs,

**[00:01:12 – 00:01:15]** just of the agents you have today already out there.

**[00:01:15 – 00:01:19]** And it can also help bring open models, maybe smaller

**[00:01:19 – 00:01:24]** models, to a performance level that is front-tier or close front-tier.

**[00:01:24 – 00:01:29]** So in the next 40 minutes, we'll show you that basically in

**[00:01:29 – 00:01:33]** one use case from the cybersecurity domain where we used self-improving

**[00:01:33 – 00:01:37]** AI to boost performance of such an open model.

**[00:01:37 – 00:01:40]** And we did that in a highly restricted environment, all

**[00:01:41 – 00:01:44]** on-prem, in an air-gapped setup, basically on one of

**[00:01:44 – 00:01:47]** these DGX Spark that you see here.

**[00:01:47 – 00:01:51]** So very small model, air-gapped, highly restricted environment,

**[00:01:51 – 00:01:55]** no front-chain model possible.

**[00:01:56 – 00:01:59]** We did this together over the last weeks with NVIDIA,

**[00:01:59 – 00:02:03]** so we present also today here together with Oleg from NVIDIA

**[00:02:03 – 00:02:07]** and Julian from our team.

**[00:02:09 – 00:02:13]** What is DeepSet? We started DeepSet here in Berlin eight

**[00:02:13 – 00:02:17]** years ago, and since then we basically helped our customers

**[00:02:17 – 00:02:23]** to deliver AI and mainly for what we call mission critical use cases,

**[00:02:23 – 00:02:28]** cases where robustness of your AI really matters; we often work

**[00:02:28 – 00:02:32]** in restricted environments, you cannot use all the tooling maybe

**[00:02:32 – 00:02:34]** that is out there, it's restricted.

**[00:02:34 – 00:02:37]** And we do that with two products.

**[00:02:37 – 00:02:40]** On the one side, many of you might know our open source

**[00:02:40 – 00:02:42]** framework, Haystack.

**[00:02:42 – 00:02:46]** It's currently, I think, used by around about 100,000 organizations

**[00:02:46 – 00:02:52]** worldwide, more than 1.5 million developers right now using it.

**[00:02:52 – 00:02:55]** And it's basically a framework to build AI, to build harnesses,

**[00:02:55 – 00:02:58]** to build also rack systems.

**[00:02:58 – 00:03:01]** And then we have our high-stake enterprise platform, which

**[00:03:01 – 00:03:05]** basically allows you then to also run this AI, to optimize

**[00:03:05 – 00:03:09]** it and to operate it at scale.

**[00:03:09 – 00:03:12]** You see a few logos who is using that.

**[00:03:12 – 00:03:17]** It's really a mix of big tech from the US and then also here in

**[00:03:17 – 00:03:23]** Europe, a lot regulated industries, public sector, big enterprise.

**[00:03:23 – 00:03:27]** So, why are we talking about this here today, and what's

**[00:03:27 – 00:03:31]** maybe also like what we saw changing in the market in

**[00:03:31 – 00:03:34]** the last, say, three, four months?

**[00:03:34 – 00:03:40]** One change for sure, I think, is if you just look at the news,

**[00:03:40 – 00:03:46]** beginning of June, Anthropic's fable basically got shut down

**[00:03:46 – 00:03:49]** by export control; people basically overnight didn't

**[00:03:49 – 00:03:53]** have access anymore here in Europe.

**[00:03:54 – 00:03:58]** And then I think pretty quickly people realized, okay, models

**[00:03:58 – 00:04:03]** is something critical, like access to that is important.

**[00:04:03 – 00:04:06]** And people came together to form the Open Secure AI Alliance

**[00:04:06 – 00:04:09]** to basically push even and more for; we need open models,

**[00:04:09 – 00:04:12]** we need open tools, right?

**[00:04:12 – 00:04:16]** And then over summer, I think more and more tailwind for

**[00:04:16 – 00:04:18]** open models happened.

**[00:04:18 – 00:04:20]** Open models were released.

**[00:04:20 – 00:04:27]** Mozilla recently open sourced a state of OpenAI report where

**[00:04:27 – 00:04:31]** they found basically open weight models right now are

**[00:04:31 – 00:04:36]** around about four months behind the top, top frontier model,

**[00:04:37 – 00:04:38]** really a fraction of the cost.

**[00:04:38 – 00:04:41]** So open models are accelerating, right?

**[00:04:41 – 00:04:43]** And then, a lot of security incidents

**[00:04:43 – 00:04:45]** happened again over the summer.

**[00:04:45 – 00:04:49]** There are multiple ones, the Hugging Face hack, of course,

**[00:04:49 – 00:04:54]** but also an OpenAI agent trying to break into Australian government.

**[00:04:54 – 00:04:59]** Just yesterday, two big PHP vulnerabilities discovered

**[00:04:59 – 00:05:04]** by AI, and now it's basically a race to who can fix it faster,

**[00:05:04 – 00:05:08]** defend us patching it, or attack as no exploiting.

**[00:05:08 – 00:05:13]** Ultimately, I think it really boils down to there is now

**[00:05:13 – 00:05:17]** a growing open model landscape because there is the need.

**[00:05:17 – 00:05:20]** People want to have this freedom of using models and relying

**[00:05:20 – 00:05:25]** on them for security, but also for many other use cases.

**[00:05:25 – 00:05:28]** And it's not only about the model at the end, because you

**[00:05:29 – 00:05:32]** all know there's a harness, there's a lot of stuff around the model

**[00:05:32 – 00:05:37]** that is needed, so we will also need high-performing, sovereign

**[00:05:37 – 00:05:42]** OpenAI stacks that people can use.

**[00:05:43 – 00:05:48]** The second market shift that we see right now is really about

**[00:05:48 – 00:05:53]** the scale of agents getting live, getting in production these days.

**[00:05:53 – 00:05:57]** What you see here is numbers from a recent Gartner report

**[00:05:57 – 00:06:02]** where they basically measured how many agents are on average

**[00:06:02 – 00:06:03]** live in a Fortune 500.

**[00:06:03 – 00:06:08]** Right now, it's less than 15.

**[00:06:08 – 00:06:14]** And they predict that this will go up to 150K in 2028.

**[00:06:14 – 00:06:19]** And I'm a trained data scientist, so I'm always skeptic when I see a

**[00:06:19 – 00:06:21]** statistic and when I see forecasts.

**[00:06:21 – 00:06:24]** But this one feels right to me.

**[00:06:24 – 00:06:28]** I think these numbers are really what we see with our customers.

**[00:06:28 – 00:06:30]** Some are already beyond 15 agents live.

**[00:06:30 – 00:06:32]** Some are behind.

**[00:06:32 – 00:06:35]** But it's really accelerating now at a crazy speed.

**[00:06:35 – 00:06:38]** And we see that also from, basically, conversations shifting

**[00:06:38 – 00:06:43]** from not anymore, how can I build my first agent or

**[00:06:43 – 00:06:46]** rack system, to now more, okay, how can I optimize, how can

**[00:06:46 – 00:06:52]** I keep them stable when they are in production, how can I operate them?

**[00:06:52 – 00:06:56]** So the big question, of course, is like, if this is here true,

**[00:06:56 – 00:07:00]** like this hockey stick, what are we doing to do, like,

**[00:07:00 – 00:07:06]** how can we actually operate these massive amount of agents at scale?

**[00:07:06 – 00:07:08]** How can you control them, right?

**[00:07:08 – 00:07:12]** And there's many things that are needed, many tools and so on.

**[00:07:12 – 00:07:17]** But one thing that we really believe in is, in the past,

**[00:07:17 – 00:07:21]** we started to use AI for building, and that worked.

**[00:07:21 – 00:07:24]** So we also need to use AI now for operating, otherwise

**[00:07:24 – 00:07:27]** there will be a huge imbalance.

**[00:07:28 – 00:07:31]** And we call this the AI operator.

**[00:07:31 – 00:07:36]** So it's basically an agent that watches continuously

**[00:07:36 – 00:07:39]** other agents that are live, that are in production.

**[00:07:39 – 00:07:44]** And this agent has access to traces, so it can spot weaknesses,

**[00:07:44 – 00:07:48]** it can spot failures, and then it can propose changes, because

**[00:07:48 – 00:07:51]** it also has access to the harness, and it can say, okay, maybe

**[00:07:51 – 00:07:54]** we need to tweak this part here.

**[00:07:54 – 00:07:57]** And it has access, and that's important, to evaluation,

**[00:07:57 – 00:08:01]** to metrics that you set up upfront, what means quality, what do

**[00:08:01 – 00:08:06]** you want to ensure, to measure if these changes really make change,

**[00:08:06 – 00:08:09]** make sense in your use case.

**[00:08:09 – 00:08:13]** And this can be used on the one side for regular maintenance

**[00:08:13 – 00:08:15]** tasks when you're in production.

**[00:08:15 – 00:08:19]** So we have a couple of customers where they're now live for

**[00:08:19 – 00:08:23]** years and regularly OpenAI or So Anthropic decides to

**[00:08:23 – 00:08:25]** deprecate a model.

**[00:08:25 – 00:08:28]** And they realize, oh, like a few days before, shit,

**[00:08:28 – 00:08:29]** we need to go over.

**[00:08:29 – 00:08:30]** We need to switch to something else.

**[00:08:31 – 00:08:35]** So this is something you can, of course, heavily automate

**[00:08:35 – 00:08:40]** with AI and make sure that you make these changes in the right time.

**[00:08:40 – 00:08:43]** Then, of course, you can use that to improve quality,

**[00:08:43 – 00:08:44]** improve performance.

**[00:08:44 – 00:08:48]** Not as a one-time job when you build the agent, where, of course,

**[00:08:49 – 00:08:53]** everyone is tweaking it, measuring it, going in, but also continuously

**[00:08:53 – 00:08:59]** over time to make sure you really benefit from also the learnings

**[00:08:59 – 00:09:02]** the AI can make when it's live.

**[00:09:02 – 00:09:04]** And last but not least, that's something I think we see right

**[00:09:04 – 00:09:06]** now as a big topic, costs.

**[00:09:06 – 00:09:10]** I think also when you launch agents, one or

**[00:09:10 – 00:09:13]** many, they get adopted.

**[00:09:13 – 00:09:15]** First, Ford is always like, hooray, we built something useful.

**[00:09:15 – 00:09:20]** And second is then, oh, it costs now actually a lot, right?

**[00:09:20 – 00:09:25]** So that's also something we see not as a one-time job when

**[00:09:25 – 00:09:29]** you launch, but also continuously over time because model providers

**[00:09:29 – 00:09:32]** change price on a weekly base.

**[00:09:34 – 00:09:40]** So this is not only now like theory or like future research;

**[00:09:40 – 00:09:43]** we have this built right now in our platform, the Anisic Enterprise

**[00:09:43 – 00:09:45]** platform, this AI operator.

**[00:09:46 – 00:09:49]** It's possible really to do it right now.

**[00:09:49 – 00:09:55]** We made this part of the platform and currently roll it out

**[00:09:55 – 00:09:56]** to the first users.

**[00:09:56 – 00:10:00]** And What you see here is basically an operator for optimizing

**[00:10:00 – 00:10:02]** costs that is applied over time.

**[00:10:02 – 00:10:08]** Set a goal that it should reduce costs but keep the quality stable.

**[00:10:10 – 00:10:13]** So you can apply, I think, this concept of an AI operator,

**[00:10:13 – 00:10:17]** of self-improving AI to many different domains.

**[00:10:17 – 00:10:19]** Now here today, we want to double-click into one of these

**[00:10:20 – 00:10:22]** domains, cybersecurity.

**[00:10:22 – 00:10:27]** I think it's one of the huge, huge topics for every CTO

**[00:10:27 – 00:10:32]** right now out there; round about 240 billion dollars spent every

**[00:10:32 – 00:10:35]** year globally on cybersecurity.

**[00:10:35 – 00:10:39]** And with AI, I think this year, this industry really

**[00:10:39 – 00:10:40]** got under pressure.

**[00:10:41 – 00:10:45]** So I think it's really high pressure, high potential industry.

**[00:10:45 – 00:10:48]** On the one side, attackers, of course, are able now to

**[00:10:48 – 00:10:54]** exploit vulnerabilities at a completely new speed, new scale.

**[00:10:54 – 00:10:58]** I'm curious to see what's happening with the PHP

**[00:10:58 – 00:10:59]** exploit from yesterday.

**[00:10:59 – 00:11:01]** But this is right now exactly that race.

**[00:11:01 – 00:11:02]** Who is faster?

**[00:11:02 – 00:11:06]** Who can do that now at scale and find targets?

**[00:11:06 – 00:11:09]** On the other side, of course, defenders use more and more

**[00:11:09 – 00:11:14]** AI on the other side, but that comes with challenges.

**[00:11:14 – 00:11:15]** Change number one, costs.

**[00:11:16 – 00:11:20]** So yes, you can also use expensive frontier models for that,

**[00:11:20 – 00:11:22]** but it's expensive.

**[00:11:22 – 00:11:25]** And also, some defenders are in restricted environments.

**[00:11:25 – 00:11:29]** Maybe they don't have access to frontier models or the ones that

**[00:11:29 – 00:11:32]** actually can defend them, right?

**[00:11:33 – 00:11:37]** Palo Alto Networks recently published a case study where

**[00:11:37 – 00:11:43]** they demonstrated the effectiveness of AI in the defense case.

**[00:11:43 – 00:11:48]** They found 24 critical vulnerabilities within three weeks.

**[00:11:48 – 00:11:53]** So I think that's awesome, cool, it works, right?

**[00:11:53 – 00:11:58]** But they also reported that they used one of the frontier

**[00:11:58 – 00:12:04]** anthropic models, and they spent around about one million on tokens.

**[00:12:04 – 00:12:07]** To put that in context, I think that not everyone, we at DeepSight,

**[00:12:07 – 00:12:11]** definitely cannot afford that.

**[00:12:11 – 00:12:15]** So, what do you do if you don't have that budget to spend?

**[00:12:15 – 00:12:18]** Or what if you run in an environment where you cannot

**[00:12:18 – 00:12:21]** use a closed model from the cloud, where you have maybe sensitive

**[00:12:21 – 00:12:24]** data, sensitive code base, that you don't want to send to

**[00:12:24 – 00:12:26]** one of these big model providers?

**[00:12:26 – 00:12:30]** So that's a question that we basically asked ourselves, that we

**[00:12:30 – 00:12:32]** heard from customers quite a lot.

**[00:12:32 – 00:12:37]** So we decided to Explore the use here of open models, of

**[00:12:37 – 00:12:41]** self-hosted models, of a small model that can fit actually on one

**[00:12:41 – 00:12:48]** of these DJX devices, and basically test, okay, how can this now work?

**[00:12:48 – 00:12:53]** Can we, with such a small model and self-improving AI, really boost

**[00:12:53 – 00:12:57]** performance to a competitive level?

**[00:12:57 – 00:13:00]** And Julian will now walk you through this project,

**[00:13:00 – 00:13:03]** what we exactly did there, and how it worked.

**[00:13:03 – 00:13:07]** Yeah, let's start with a look at the task we actually

**[00:13:07 – 00:13:08]** want to solve here.

**[00:13:08 – 00:13:12]** So how do we want to support the defenders?

**[00:13:12 – 00:13:16]** We ourselves maintain more than a hundred of confidential

**[00:13:17 – 00:13:21]** components, custom components, code that our customers implemented.

**[00:13:21 – 00:13:27]** So that is code we cannot just send to any API model.

**[00:13:27 – 00:13:31]** We also maintain a large number of public components,

**[00:13:31 – 00:13:34]** so core integrations with any kinds of databases,

**[00:13:34 – 00:13:36]** model providers, and so on.

**[00:13:36 – 00:13:39]** And all these lines of code we want to check; we want

**[00:13:39 – 00:13:42]** to detect vulnerabilities in them.

**[00:13:42 – 00:13:45]** So the task really is here to go through all these lines

**[00:13:45 – 00:13:49]** of code and see if we can find anything vulnerable, so that

**[00:13:49 – 00:13:53]** we know what we need to fix before others start exploiting this.

**[00:13:53 – 00:13:58]** We have the public code as the real-world data we can

**[00:13:58 – 00:14:01]** use, but we also have the confidential code base, and

**[00:14:01 – 00:14:05]** for that we built a synthetic data set that is as close as possible

**[00:14:05 – 00:14:07]** to this real-world data set.

**[00:14:07 – 00:14:10]** We also planted some vulnerabilities into

**[00:14:10 – 00:14:13]** these lines of code so that we can evaluate our models

**[00:14:13 – 00:14:19]** and check if they are able to find these planted vulnerabilities.

**[00:14:20 – 00:14:23]** Here is one example of vulnerability so that

**[00:14:23 – 00:14:26]** you know what we are dealing with.

**[00:14:26 – 00:14:30]** This is one of the vulnerabilities we got through security reports.

**[00:14:30 – 00:14:34]** You can imagine this is sometimes SQL injection, in particular

**[00:14:34 – 00:14:38]** with the integrations for vector databases, but also many other

**[00:14:38 – 00:14:42]** kinds of weaknesses in the code.

**[00:14:45 – 00:14:47]** So let's look at the solution.

**[00:14:47 – 00:14:50]** This is the solution architecture for what we built.

**[00:14:50 – 00:14:52]** And let's start in the center.

**[00:14:52 – 00:14:55]** In the center, you see the Haystack agent.

**[00:14:55 – 00:15:00]** That agent is the one that tries to find the vulnerabilities

**[00:15:00 – 00:15:02]** in the lines of code.

**[00:15:02 – 00:15:05]** And for that, it has access to a couple of different tools.

**[00:15:05 – 00:15:10]** For example, it can read files, but it also has access to

**[00:15:10 – 00:15:14]** a knowledge base of known vulnerabilities from the past.

**[00:15:14 – 00:15:16]** And then it needs to go through all lines of code and tell

**[00:15:16 – 00:15:22]** us which one is vulnerable and which lines are not vulnerable.

**[00:15:22 – 00:15:27]** This Haystack agent is driven by NVIDIA NIM and local NEMOtron

**[00:15:27 – 00:15:32]** models, so the NVIDIA inference microservice, and this is

**[00:15:32 – 00:15:36]** what we could call, let's say, the brain of this agent, right?

**[00:15:36 – 00:15:38]** This is what powers this agent.

**[00:15:38 – 00:15:42]** This is the LLM behind this.

**[00:15:42 – 00:15:46]** All this sits in a sandbox, in NemoClaw and OpenShell,

**[00:15:46 – 00:15:50]** and Oleg will talk more about that in a second.

**[00:15:50 – 00:15:52]** But let me walk you also through what this agent

**[00:15:52 – 00:15:53]** now does when it's running.

**[00:15:53 – 00:15:56]** Where does the self-improvement come into play?

**[00:15:56 – 00:16:00]** So when we run the security agent, the one in the center,

**[00:16:00 – 00:16:01]** we can collect the traces.

**[00:16:01 – 00:16:04]** We can see what tool calls it made.

**[00:16:04 – 00:16:08]** We can see what knowledge base requests it made.

**[00:16:08 – 00:16:12]** And we can also see where it was successful or where it failed,

**[00:16:12 – 00:16:17]** because for our training data set, we have ground truth labels.

**[00:16:17 – 00:16:21]** And these traces are then the input to NemoGym and our

**[00:16:22 – 00:16:23]** Haystack Meta agent.

**[00:16:23 – 00:16:27]** That is the AI operator that is for self-improvement that

**[00:16:27 – 00:16:28]** Malte already introduced.

**[00:16:28 – 00:16:34]** So we're using all these traces as input again to another agent

**[00:16:34 – 00:16:41]** that tries to find improvements of our entire harness configuration

**[00:16:41 – 00:16:44]** of our security agent.

**[00:16:44 – 00:16:48]** And when these improvements got generated, they can also

**[00:16:48 – 00:16:52]** get evaluated thanks to NemoGym that rolls this out with an

**[00:16:52 – 00:16:57]** efficient agent execution, so an open-source agent evaluation

**[00:16:57 – 00:17:01]** framework, so that we know which of the changed configurations,

**[00:17:01 – 00:17:05]** which of the improvements actually improved performance

**[00:17:05 – 00:17:11]** also on holdout validation data or holdout test data.

**[00:17:11 – 00:17:15]** And that improvement then goes back to the human who can approve

**[00:17:15 – 00:17:17]** or disapprove these changes.

**[00:17:17 – 00:17:22]** And if the changes are approved, the loop closes, and we update

**[00:17:22 – 00:17:25]** the Haystack agent in the center.

**[00:17:26 – 00:17:29]** And I hand over to Oleg now to talk a bit more about NVIDIA

**[00:17:29 – 00:17:30]** NeMo and Nemo Gym.

**[00:17:30 – 00:17:35]** Yes, so briefly mentioning, NVIDIA NeMo is running a Nemotron

**[00:17:35 – 00:17:38]** model, and the Nemotron model is a family of open-source

**[00:17:38 – 00:17:43]** NVIDIA models which were designed for accuracy, performance,

**[00:17:43 – 00:17:45]** and also customizability.

**[00:17:45 – 00:17:49]** So there are models of different size, and DGX Spark supports

**[00:17:49 – 00:17:53]** models up to 200 billion parameters inside.

**[00:17:54 – 00:17:56]** But, well, you might have a question that, well, we

**[00:17:56 – 00:17:59]** have an air-gapped system, it's disconnected from the

**[00:17:59 – 00:18:03]** internet; why do we even need additional sandboxing, why

**[00:18:03 – 00:18:05]** do we need an open shell?

**[00:18:05 – 00:18:08]** So, for that, let's take a step back.

**[00:18:08 – 00:18:13]** We are in 2026, and we are probably not so satisfied

**[00:18:13 – 00:18:14]** with chatbots anymore.

**[00:18:15 – 00:18:18]** We want our agents to solve advanced tasks.

**[00:18:18 – 00:18:20]** Our needs get bigger and bigger.

**[00:18:20 – 00:18:23]** We want to go large with what we're able to do.

**[00:18:23 – 00:18:26]** And because of that, we need to provide agents additional

**[00:18:26 – 00:18:29]** tools, additional access to the file system, and, of course,

**[00:18:29 – 00:18:32]** additional access to the internet.

**[00:18:32 – 00:18:36]** And over time, ambiguous instructions can cause the

**[00:18:36 – 00:18:40]** agent to solve the task in a somewhat unpredictable way.

**[00:18:40 – 00:18:43]** And because the agent has access to the operating system,

**[00:18:43 – 00:18:48]** files, and the internet, this gives us three surface areas that

**[00:18:48 – 00:18:49]** can potentially be compromised.

**[00:18:50 – 00:18:52]** By eliminating the internet and putting everything in

**[00:18:53 – 00:18:57]** an air-gapped system, we still have potential issues with

**[00:18:57 – 00:19:00]** the operating system and the files.

**[00:19:00 – 00:19:03]** And you might have used the usual sandboxing solutions,

**[00:19:04 – 00:19:08]** for example, Codex or Cloud Code; they execute tools in sandbox.

**[00:19:08 – 00:19:12]** But those traditional solutions might not be secure enough

**[00:19:12 – 00:19:16]** because they can still give a significant degree of access

**[00:19:16 – 00:19:20]** to operating systems and files.

**[00:19:20 – 00:19:23]** And in addition, if something goes wrong, if the system gets

**[00:19:23 – 00:19:28]** somehow compromised, there will be no record of the agent actions, and

**[00:19:28 – 00:19:35]** it will be complicated to prevent the same incidents in the future.

**[00:19:35 – 00:19:39]** So for that, we have a solution called OpenShell, which is

**[00:19:39 – 00:19:44]** essentially a software-defined security layer for agents.

**[00:19:44 – 00:19:48]** So in OpenShell, we can provide policies that will restrict

**[00:19:48 – 00:19:51]** their agent access to the operating system components, to the

**[00:19:51 – 00:19:54]** file system, and to the network.

**[00:19:54 – 00:19:58]** And having a solution designed for the agentic error becomes

**[00:19:58 – 00:20:01]** especially crucial when those agents are getting more and

**[00:20:01 – 00:20:05]** more capable and when we are moving towards the agent swarms,

**[00:20:05 – 00:20:08]** in which every agent has a different objective and might

**[00:20:08 – 00:20:12]** need access to different web services or different files.

**[00:20:12 – 00:20:16]** So to sum up, there are three ways in which the execution goes wrong.

**[00:20:16 – 00:20:19]** So the first one is when agent accesses something

**[00:20:19 – 00:20:21]** when it's not supposed to.

**[00:20:21 – 00:20:24]** The second one is when available accesses are

**[00:20:24 – 00:20:26]** combined in unexpected ways.

**[00:20:26 – 00:20:29]** And finally, potentially, the agent can also escape

**[00:20:29 – 00:20:31]** from the software sandbox.

**[00:20:31 – 00:20:35]** And for that, we have a solution running on BlueField

**[00:20:35 – 00:20:39]** for DPUs, which is called NVIDIA Sentry, and which

**[00:20:39 – 00:20:44]** can detect anomalies and quarantine the agent in milliseconds.

**[00:20:44 – 00:20:48]** And now we are going back to the demo.

**[00:20:49 – 00:20:51]** Sorry, not to the demo yet.

**[00:20:51 – 00:20:54]** Yeah, so just to sum up how everything comes together.

**[00:20:54 – 00:20:59]** So in the center, we have models powered by NVIDIA NIM

**[00:20:59 – 00:21:02]** and powering the NIMatron model.

**[00:21:02 – 00:21:06]** The model is located inside the inner harness, which is implemented

**[00:21:06 – 00:21:10]** in Haystack and has access to tools, state, and context.

**[00:21:10 – 00:21:14]** And finally, we have an outer harness or a meta agent, which

**[00:21:14 – 00:21:18]** powers the harness and potentially also the model improvement.

**[00:21:18 – 00:21:22]** And as the agents get more and more advanced, they require

**[00:21:22 – 00:21:26]** full AI governance that would bring together access, verified

**[00:21:26 – 00:21:30]** capabilities, sandboxing, and a full audit.

**[00:21:30 – 00:21:34]** So this in turn enables secure execution, reliable performance,

**[00:21:34 – 00:21:36]** and cost management.

**[00:21:36 – 00:21:39]** And it's crucial to mention that as the solution is fully

**[00:21:39 – 00:21:43]** open source, organizations can control the entire stack

**[00:21:43 – 00:21:47]** and the whole solution from a low level to higher level, end to end.

**[00:21:47 – 00:21:51]** So we stay in command of model, harness model improvement,

**[00:21:51 – 00:21:55]** costs, security, and we can intervene in execution as needed.

**[00:21:56 – 00:21:59]** And finally, it's time for the demo.

**[00:21:59 – 00:22:03]** Yeah, so to show you that the demo we are running here

**[00:22:03 – 00:22:06]** can actually run in this air-gapped setting, we also brought this

**[00:22:06 – 00:22:08]** small DGX Spark with us.

**[00:22:09 – 00:22:12]** Maybe you can see it also.

**[00:22:12 – 00:22:15]** Everything you saw on the architecture slide is running

**[00:22:15 – 00:22:17]** on this DGX Spark right now.

**[00:22:18 – 00:22:21]** So let's have a look into that.

**[00:22:21 – 00:22:24]** So what you see here are the code samples.

**[00:22:24 – 00:22:27]** This is one sample from the training data set.

**[00:22:27 – 00:22:33]** And the agent's task here is to decide for both of these samples

**[00:22:33 – 00:22:36]** if they are vulnerable or not.

**[00:22:36 – 00:22:38]** So this is what the agent needs to look at.

**[00:22:38 – 00:22:40]** And for that, we have the cybersecurity agent that can

**[00:22:40 – 00:22:43]** call tools and so on and so on.

**[00:22:43 – 00:22:45]** And if you want to come to the booth later on, we can

**[00:22:45 – 00:22:46]** also do a small quiz.

**[00:22:47 – 00:22:49]** Just because I've seen this before, I know this one is

**[00:22:49 – 00:22:51]** the vulnerable example.

**[00:22:51 – 00:22:53]** The other one is actually fixed.

**[00:22:53 – 00:22:56]** So this is the task the agent needs to solve.

**[00:22:56 – 00:23:00]** Now we can actually run this live, and I can walk you through

**[00:23:00 – 00:23:02]** what's happening here.

**[00:23:02 – 00:23:07]** So for this live demo, we took one sample from the training data set.

**[00:23:07 – 00:23:10]** And we asked our cybersecurity agent, the one you saw in

**[00:23:10 – 00:23:15]** the center of the architecture slide, to find a vulnerability

**[00:23:15 – 00:23:17]** in this code sample.

**[00:23:17 – 00:23:20]** So, this is the path to the code, and we know that there is

**[00:23:20 – 00:23:24]** one vulnerable line of code where we load a secret directly into

**[00:23:24 – 00:23:29]** a variable, whereas in the fixed example, that is not vulnerable.

**[00:23:29 – 00:23:33]** We only load the environment variable name.

**[00:23:33 – 00:23:36]** So, rather simple example out of the ones we have, I would say.

**[00:23:36 – 00:23:42]** And then what we kept track of here is what our cybersecurity agent

**[00:23:42 – 00:23:47]** initially tried to do to evaluate if there's any vulnerability.

**[00:23:47 – 00:23:51]** So you can see here the tool calls it made.

**[00:23:51 – 00:23:53]** This tool calls to a read file tool.

**[00:23:53 – 00:23:57]** It ran some Python code, then it did some reasoning, and

**[00:23:57 – 00:24:00]** in the end it generated a report.

**[00:24:00 – 00:24:04]** And truth is, actually, in this case, it was wrong, so

**[00:24:04 – 00:24:07]** it did not correctly identify the vulnerable code.

**[00:24:07 – 00:24:10]** It's not always that easy.

**[00:24:10 – 00:24:15]** What happens next is that These traces that you saw here, the tool

**[00:24:15 – 00:24:20]** calls that the cybersecurity agent made, and also the result, are

**[00:24:20 – 00:24:26]** handed over to our AI operator, to this optimizer, to this meta agent.

**[00:24:26 – 00:24:31]** And that meta agent now tries to understand, what can we optimize?

**[00:24:31 – 00:24:35]** What can we change in the Haystack agent configuration?

**[00:24:35 – 00:24:40]** For example, we can add a tool maybe, or we can change a prompt.

**[00:24:40 – 00:24:43]** We can tweak some parameters in the cybersecurity agent.

**[00:24:44 – 00:24:47]** What can we change to improve the performance?

**[00:24:47 – 00:24:49]** And then it, again, makes tool calls.

**[00:24:49 – 00:24:50]** It edits the file.

**[00:24:50 – 00:24:54]** In this case, it just edited the prompt.

**[00:24:54 – 00:24:59]** It validates if this new candidate configuration is actually runnable,

**[00:24:59 – 00:25:01]** and then submits the candidate.

**[00:25:01 – 00:25:05]** So everything here in this box happened here.

**[00:25:05 – 00:25:08]** Nemotron 3.5 superpowers this,

**[00:25:09 – 00:25:12]** both the cybersecurity agent, but also the optimizer.

**[00:25:12 – 00:25:16]** So also the optimization, it all runs on the DGX Spark.

**[00:25:16 – 00:25:18]** We can see what the optimizer changed.

**[00:25:18 – 00:25:20]** So for this demo, we can actually have a look.

**[00:25:20 – 00:25:23]** It, in this case, again, only changed the prompt.

**[00:25:23 – 00:25:26]** When we showed that at the booth yesterday, sometimes

**[00:25:26 – 00:25:29]** this also changes the tool.

**[00:25:29 – 00:25:34]** And then this is measured now on the training data set to first see

**[00:25:34 – 00:25:39]** if we can improve the performance on this one Training sample.

**[00:25:39 – 00:25:42]** And then we as a human will be asked if we actually

**[00:25:42 – 00:25:46]** want to roll out that change, then I can approve.

**[00:25:46 – 00:25:50]** And if I approve, then we also can see the performance

**[00:25:50 – 00:25:51]** on the validation set.

**[00:25:51 – 00:25:54]** And this entire run-through on one training sample takes

**[00:25:54 – 00:25:56]** about three to four minutes.

**[00:25:56 – 00:25:58]** So you see the pop-up here now.

**[00:25:58 – 00:26:03]** We see that the performance now has improved on this small

**[00:26:03 – 00:26:07]** training sample of one pair.

**[00:26:07 – 00:26:10]** And if I approve, then we actually now also check whether

**[00:26:10 – 00:26:16]** the performance can be reproduced on a validation set.

**[00:26:17 – 00:26:21]** Now zooming out a bit, here is one visualization of multiple

**[00:26:21 – 00:26:25]** iterations of this on the full training set of our synthetic

**[00:26:25 – 00:26:29]** data, where you can see this blue dot here is where the

**[00:26:29 – 00:26:30]** seed agent starts.

**[00:26:30 – 00:26:35]** So this cybersecurity agent without any self-improvement,

**[00:26:35 – 00:26:39]** it has a pairwise accuracy of 33%.

**[00:26:40 – 00:26:43]** And then the smaller dots here, not on the blue line, are the

**[00:26:43 – 00:26:46]** performance on the validation set.

**[00:26:46 – 00:26:50]** You see that even after one iteration, the performance

**[00:26:50 – 00:26:53]** on the training data set drastically increases.

**[00:26:53 – 00:26:57]** It also increases on the validation set, but not as much.

**[00:26:57 – 00:27:01]** And then we see, going forward with more iterations, that

**[00:27:01 – 00:27:06]** the performance on the training dataset further improves.

**[00:27:06 – 00:27:10]** The best performance on the validation set was achieved

**[00:27:10 – 00:27:12]** here in this iteration four.

**[00:27:12 – 00:27:16]** So this is also the agent we would now deploy after

**[00:27:16 – 00:27:19]** all the self-improvement and stop further iterations here,

**[00:27:19 – 00:27:23]** because as you can see, there is also a risk of overfitting

**[00:27:23 – 00:27:29]** on the training dataset given that it is rather small data set.

**[00:27:30 – 00:27:35]** I'd be happy to show you more here; let's jump back to the slides.

**[00:27:36 – 00:27:44]** We also evaluated the results on the full data set, and what

**[00:27:44 – 00:27:48]** you can see here are essentially three different data sets.

**[00:27:48 – 00:27:52]** One is on the right-hand side, the customer data, where we

**[00:27:52 – 00:27:57]** have the lower bar, the seed agent, the one without any improvements.

**[00:27:57 – 00:28:02]** And then the looped versions, so the one after self-improvement

**[00:28:02 – 00:28:06]** that actually doubled the pairwise accuracy on that data set.

**[00:28:06 – 00:28:10]** Then in the center, you have the public data set of our Haystack

**[00:28:10 – 00:28:14]** core integrations, a bit more than 100 different integrations

**[00:28:14 – 00:28:19]** where we planted vulnerabilities to see how many of them our

**[00:28:19 – 00:28:21]** cybersecurity agent can find.

**[00:28:21 – 00:28:28]** Without the self-improvement, it found 54% of those.

**[00:28:28 – 00:28:34]** And as you saw with the training data set performance, that

**[00:28:34 – 00:28:35]** can also improve.

**[00:28:35 – 00:28:40]** But also to show you the real results, this is one example there.

**[00:28:40 – 00:28:43]** We were better with that agent on the validation set, too.

**[00:28:43 – 00:28:47]** But on the holdout test data set, the performance was slightly

**[00:28:47 – 00:28:49]** worse, which is part of the story.

**[00:28:49 – 00:28:53]** If you have a holdout test data set, we can't possibly

**[00:28:53 – 00:28:56]** know the performance in advance and then pick the best agent

**[00:28:56 – 00:28:58]** according to that performance.

**[00:28:58 – 00:29:02]** But what you also see here for the center is the smaller

**[00:29:02 – 00:29:04]** numbers, the false positive rate.

**[00:29:04 – 00:29:07]** And in fact, there you can see an improvement also on

**[00:29:07 – 00:29:10]** this holdout test data set with the self-improvement loop, because

**[00:29:10 – 00:29:17]** we halved the false positive rate, meaning that if the agent tells

**[00:29:17 – 00:29:21]** us that something is vulnerable, it's now also more reliable.

**[00:29:21 – 00:29:24]** It's not a false positive much more often.

**[00:29:25 – 00:29:28]** And then we have also more synthetic training data sets

**[00:29:28 – 00:29:31]** and validation data sets.

**[00:29:31 – 00:29:34]** One more slide, which is the Primeval Benchmark.

**[00:29:34 – 00:29:38]** So this is a public benchmark, not our data, to also show that these

**[00:29:38 – 00:29:42]** self-improvement loops can bring performance improvements there.

**[00:29:42 – 00:29:47]** On the right-hand side, you have some numbers from us.

**[00:29:47 – 00:29:49]** And on the left-hand side, you have related work.

**[00:29:49 – 00:29:53]** And what we can see here is that the Nemotron model alone

**[00:29:53 – 00:29:55]** is doing quite well.

**[00:29:55 – 00:29:58]** We did some low-rank adaptations, some post-training also to

**[00:29:58 – 00:30:00]** see how far we can get there.

**[00:30:00 – 00:30:03]** See 20% pairwise accuracy.

**[00:30:03 – 00:30:05]** And then we looked into the self-improvement.

**[00:30:05 – 00:30:10]** So the seed agent got drastically improved by the loop.

**[00:30:10 – 00:30:15]** The self-improvement got us to 21% on this public benchmark.

**[00:30:15 – 00:30:19]** And we also checked how far we can get performance with

**[00:30:19 – 00:30:23]** some manual tweaking to have an upper bound, let us say,

**[00:30:23 – 00:30:25]** what we would expect from an agent.

**[00:30:25 – 00:30:30]** And for this, we achieved almost like 25 percent.

**[00:30:33 – 00:30:38]** Yeah, now, to zoom out a bit more again, I think you saw

**[00:30:38 – 00:30:41]** how we can apply that to the cybersecurity case, also do

**[00:30:41 – 00:30:46]** the self-improving basically in one loop before we then use that agent.

**[00:30:46 – 00:30:49]** You can also do that now once it's live, right?

**[00:30:49 – 00:30:53]** You can continue applying the self-improving mechanism.

**[00:30:53 – 00:30:55]** And why does it matter?

**[00:30:55 – 00:30:57]** Because I think one thing we all learned, I think, with

**[00:30:57 – 00:31:02]** agents, especially if they are live for a longer time,

**[00:31:02 – 00:31:06]** you can simply not put them to deploy and then forget, right?

**[00:31:06 – 00:31:10]** You cannot just initially say, okay, they work, and

**[00:31:10 – 00:31:13]** then forget about them and think they will just continue

**[00:31:13 – 00:31:15]** the same way over a longer time.

**[00:31:15 – 00:31:19]** That doesn't work for agentic AI systems.

**[00:31:19 – 00:31:22]** You really need to apply continuous optimization,

**[00:31:22 – 00:31:27]** continuous adaptation, otherwise these agents will degrade.

**[00:31:27 – 00:31:30]** And either you do that manually, you put a team on it continuously,

**[00:31:30 – 00:31:33]** but if you want to scale it, I think at some point

**[00:31:33 – 00:31:36]** that won't work out.

**[00:31:37 – 00:31:43]** So if you want to have quality over time, cost, stability, you

**[00:31:43 – 00:31:48]** need to find a way to continuously adapt your agents that are live.

**[00:31:49 – 00:31:54]** The second, maybe take away from this on a higher level,

**[00:31:54 – 00:31:59]** I think we saw that open models are really a choice now.

**[00:31:59 – 00:32:06]** Like, this is a super small local model on one of these DGX devices.

**[00:32:06 – 00:32:09]** There are of course also larger models that are open that

**[00:32:09 – 00:32:10]** you can use right now.

**[00:32:10 – 00:32:16]** But I think with this combination of fine-tuning or also

**[00:32:16 – 00:32:21]** self-improving, they become really an option for many use cases.

**[00:32:21 – 00:32:25]** And I think there are two dimensions why, as an organization,

**[00:32:25 – 00:32:28]** you might want to think about open models.

**[00:32:28 – 00:32:32]** The one is really, I would say, around ownership, compliance.

**[00:32:32 – 00:32:38]** Maybe you have AI use cases where open models are the only choice.

**[00:32:38 – 00:32:41]** You cannot use public models, closed source

**[00:32:41 – 00:32:43]** models from the cloud.

**[00:32:43 – 00:32:47]** So if you want to unlock these use cases for AI, that's your

**[00:32:47 – 00:32:49]** only choice, right?

**[00:32:49 – 00:32:52]** What you also hear a lot is, especially in regulated industries,

**[00:32:52 – 00:32:58]** restricted environments, transparency and guaranteed

**[00:32:58 – 00:32:59]** long-time access.

**[00:32:59 – 00:33:01]** So this model is yours, right?

**[00:33:01 – 00:33:03]** You can go down into the weights.

**[00:33:03 – 00:33:04]** You can really inspect what's happening.

**[00:33:04 – 00:33:10]** There's for sure nothing around that you don't know, which might be

**[00:33:10 – 00:33:13]** hidden behind an API in the cloud.

**[00:33:13 – 00:33:16]** And no one can take it away from you.

**[00:33:16 – 00:33:20]** If it's running on your infra, it's there, right?

**[00:33:20 – 00:33:24]** And then on the other side, I think it also has some technical

**[00:33:24 – 00:33:30]** advantages, which I think we see now a bit like a renaissance of

**[00:33:30 – 00:33:35]** fine-tuning models, which we used to do, I think, in the ML industry

**[00:33:35 – 00:33:38]** a lot five years ago, 10 years ago.

**[00:33:38 – 00:33:41]** For some time then, I think it was not really Meaningful,

**[00:33:41 – 00:33:44]** didn't give you big performance boosts, but I think now we

**[00:33:44 – 00:33:48]** are seeing again, okay, it's an interesting direction.

**[00:33:48 – 00:33:52]** And if you have open models, you can of course do that, right?

**[00:33:52 – 00:33:54]** You can do post-training.

**[00:33:54 – 00:33:58]** You can also do quantization, distillation.

**[00:33:58 – 00:34:04]** So maybe not aiming for performance changes, but really speed or costs.

**[00:34:04 – 00:34:08]** And of course, you can also do stuff like adding watermarks,

**[00:34:08 – 00:34:12]** customizing things around the model, if you publish

**[00:34:12 – 00:34:16]** these models or give them out to other customers.

**[00:34:17 – 00:34:25]** So with that, I'd like to close and just invite all of you to basically

**[00:34:25 – 00:34:29]** collaborate on that effort as an ecosystem, as a community.

**[00:34:29 – 00:34:33]** I think we're right now really in a phase where you can build

**[00:34:33 – 00:34:37]** so much with AI, so much is happening at rapid speed, that

**[00:34:37 – 00:34:41]** I think it really takes the whole community to build safe AI, truly

**[00:34:41 – 00:34:47]** open AI stacks, and also in this project, as mentioned earlier, we

**[00:34:47 – 00:34:49]** collaborated with a lot of people.

**[00:34:49 – 00:34:54]** You see here more names from Deepset and NVIDIA on that slide.

**[00:34:54 – 00:35:01]** And if you're interested in that, check out our open source GitHub.

**[00:35:01 – 00:35:05]** There we have a lot of these use cases and projects that

**[00:35:05 – 00:35:06]** you can just take and explore.

**[00:35:06 – 00:35:09]** Of course, also our Haystack open source framework.

**[00:35:09 – 00:35:11]** And we also have a booth just basically in front

**[00:35:11 – 00:35:13]** here of that room.

**[00:35:13 – 00:35:16]** If you want to see the demo maybe in a bit more depth or have

**[00:35:16 – 00:35:21]** other questions, just come over, and I'm happy to dive into that.

**[00:35:21 – 00:35:22]** Yeah, and with that, thanks, everyone.

**[00:35:22 – 00:35:25]** I'm glad to see it.

**[00:35:33 – 00:35:36]** And I think we have like five minutes, four minutes

**[00:35:36 – 00:35:37]** kind of left for Q&A.

**[00:35:37 – 00:35:43]** So, if there are any questions right now?

**[00:35:44 – 00:35:46]** Yeah, there's...

**[00:35:48 – 00:35:53]** Yeah, so I have a question, is how your agent is performing

**[00:35:53 – 00:35:56]** comparing to Frontier model and Cybersecurity?

**[00:35:56 – 00:36:01]** Like, for example, if we take like the last Fable model

**[00:36:01 – 00:36:02]** or something like this?

**[00:36:02 – 00:36:06]** Yeah, so I mean for this particular use case now, we really restricted

**[00:36:07 – 00:36:09]** us to That device here, right?

**[00:36:09 – 00:36:14]** So also it means from the open models, we took a very small one.

**[00:36:14 – 00:36:19]** So that's not comparable to a Fable or a Mythos, of course.

**[00:36:19 – 00:36:22]** But I think we are on a competitive level to many

**[00:36:22 – 00:36:28]** of the mid-sized language models.

**[00:36:29 – 00:36:32]** That, I think, is realistic to say.

**[00:36:32 – 00:36:36]** I would also say it does not compare, because if you try

**[00:36:36 – 00:36:40]** to solve this primeval benchmark with a fable, you get, maybe you

**[00:36:40 – 00:36:44]** can try; it won't do that for you.

**[00:36:44 – 00:36:47]** It will say no.

**[00:36:50 – 00:36:52]** Thank you very much for your presentation.

**[00:36:52 – 00:36:56]** It was very informative to see what you were doing.

**[00:36:56 – 00:36:59]** You mentioned a few positives around having these open source

**[00:37:00 – 00:37:03]** models and hosting them and what you can gain.

**[00:37:03 – 00:37:05]** But I guess there are lots of costs attached, right, in

**[00:37:05 – 00:37:09]** terms of being able to have them, how they scale, how you make them

**[00:37:09 – 00:37:13]** performant, the hardware that you need to make that possible, all the

**[00:37:13 – 00:37:15]** redundancies you need and so on.

**[00:37:15 – 00:37:17]** So can you speak a bit more about how you expect this

**[00:37:17 – 00:37:21]** method to sort of scale to someone who's going to take this

**[00:37:21 – 00:37:26]** and use it in a real cybersecurity situation or other situations which

**[00:37:26 – 00:37:28]** would use your sort of harnesses?

**[00:37:28 – 00:37:30]** Thank you.

**[00:37:30 – 00:37:33]** Yeah, I think that's actually right now.

**[00:37:33 – 00:37:35]** You just point to basically one of the also hard parts

**[00:37:35 – 00:37:37]** with open models, right?

**[00:37:37 – 00:37:41]** In the Mozilla report that I mentioned earlier, they

**[00:37:41 – 00:37:45]** did like a huge, huge survey among devs and basically companies

**[00:37:45 – 00:37:50]** using AI, how they use open models and what are the main barriers.

**[00:37:50 – 00:37:54]** And I think deploying them at scale, managing inference right

**[00:37:54 – 00:37:57]** now, I think, is one of the top barriers and challenges for people.

**[00:37:57 – 00:38:00]** So you see a lot of people experimenting with AI, building

**[00:38:00 – 00:38:03]** something, but they're not really putting it into production,

**[00:38:03 – 00:38:06]** or at least at a lower fraction.

**[00:38:06 – 00:38:08]** But this is changing right now.

**[00:38:08 – 00:38:10]** So I think right now at the point where it gets actually

**[00:38:10 – 00:38:14]** easier, there's a lot of new projects out there to deploy

**[00:38:14 – 00:38:19]** faster, to manage inference, and as the models are also

**[00:38:19 – 00:38:22]** relatively small, it gets easier.

**[00:38:22 – 00:38:24]** Like in this one, of course, it's like a very small

**[00:38:24 – 00:38:26]** one, a very easy one.

**[00:38:26 – 00:38:29]** But we have a couple of customers where they also

**[00:38:29 – 00:38:31]** do that now at large scale.

**[00:38:31 – 00:38:34]** And often it's then also, to be honest, it's a mix

**[00:38:35 – 00:38:35]** of models, right?

**[00:38:35 – 00:38:40]** You have some use case that can go to the cloud and to public models.

**[00:38:40 – 00:38:41]** So you might just use them.

**[00:38:41 – 00:38:44]** And then you have some workloads, some use cases, like maybe

**[00:38:44 – 00:38:49]** this one, where you need an on-prem model where data cannot

**[00:38:49 – 00:38:51]** leave your environment.

**[00:38:51 – 00:38:54]** And that's where we see it's

**[00:38:55 – 00:38:58]** a positive ROI also for the people using that.

**[00:38:58 – 00:39:01]** And if you do have access to a DGX Spark like this one,

**[00:39:01 – 00:39:04]** I would encourage you to look at our open source repository

**[00:39:04 – 00:39:08]** because we have there all the scripts you need to deploy

**[00:39:08 – 00:39:13]** exactly the demo we showed today with open world on a DGX Spark.

**[00:39:13 – 00:39:17]** So this full setup is open source so that you can replicate

**[00:39:17 – 00:39:20]** it if you have access to one.

**[00:39:20 – 00:39:22]** Maybe that's important to stress, because I think if I got it,

**[00:39:22 – 00:39:26]** like all what we show today is open source; we published it this week,

**[00:39:26 – 00:39:30]** so it's out there, check it out.

**[00:39:31 – 00:39:35]** Hi, thank you for the nice talk, super interesting.

**[00:39:35 – 00:39:39]** What I was wondering about is that you mentioned that you keep

**[00:39:39 – 00:39:43]** self-improving these models, you use training samples to train the

**[00:39:43 – 00:39:50]** models on, and how do you ensure that these new samples that you

**[00:39:50 – 00:39:54]** use are actually correct and that you're training on good quality

**[00:39:54 – 00:39:59]** data and eliminating it essentially to degrade the model over time?

**[00:40:00 – 00:40:04]** Yeah, so I think for that, it all comes down to evaluation.

**[00:40:04 – 00:40:08]** Like, you need a solid evaluation underneath

**[00:40:08 – 00:40:09]** to actually do self-improving.

**[00:40:09 – 00:40:12]** And that means you need a solid data set and you also

**[00:40:12 – 00:40:16]** need solid EVA criteria or metrics.

**[00:40:16 – 00:40:22]** For doing this now continuously over time, there's two options.

**[00:40:22 – 00:40:27]** Either you keep a kind of static data set that you create once.

**[00:40:27 – 00:40:30]** And so, okay, I want to then still continuously Improve

**[00:40:30 – 00:40:32]** and continue with that.

**[00:40:32 – 00:40:38]** But if you really have a live agent that is out there, it's often more

**[00:40:38 – 00:40:44]** powerful to use live traces then, that you say, OK, from the traces

**[00:40:44 – 00:40:51]** that I collect live over time, I pick basically the cases that are

**[00:40:51 – 00:40:56]** now relevant for the optimizer to show the optimizer, here are some

**[00:40:57 – 00:41:02]** weaknesses, some things that don't work, and then to basically suggest

**[00:41:02 – 00:41:03]** new changes, new optimizations.

**[00:41:04 – 00:41:08]** And for that mechanism, again, you can use an LLM to decide

**[00:41:08 – 00:41:12]** what traces you want to pick.

**[00:41:12 – 00:41:15]** Or maybe just a subset where you think, OK, this is now

**[00:41:15 – 00:41:18]** the case that I care most about.

**[00:41:18 – 00:41:21]** Sometimes you can integrate external signals.

**[00:41:21 – 00:41:25]** If you know, for example, a code change was afterwards

**[00:41:25 – 00:41:29]** accepted and deployed or not.

**[00:41:29 – 00:41:32]** But that's basically where it depends on the use case.

**[00:41:32 – 00:41:36]** And we optimized only in this slides for the accuracy, let's say.

**[00:41:36 – 00:41:40]** But you can optimize also for tokens per task or time per task.

**[00:41:40 – 00:41:43]** So I know already the agent can solve this task, but maybe

**[00:41:43 – 00:41:46]** I can make it so that it uses fewer tool calls.

**[00:41:46 – 00:41:48]** That's another thing I can optimize for.

**[00:41:48 – 00:41:50]** I think we're out of time.

**[00:41:50 – 00:41:51]** Thank you so much, everyone.

**[00:41:51 – 00:41:51]** Thanks, everyone.