Anaconda's Wang Warns Enterprise AI Sits on Decades of Tech Debt

Anaconda的Peter Wang警告：企业AI背负数十年技术债 由于生成式AI工具在缺乏供应链治理的情况下将未经审核的开源Python依赖项和开放权重模型扩散至企业网络，企业正面临严重的安全与法律责任。 Peter Wang拨开AI炒作指出，现代人工智能建立在开源数值Python技术栈二十年来未解决的技术债务之上。随着非开发人员和数据科学家直接将未经审核的软件包拉取到笔记本电脑中，企业面临着日益严峻的软件供应链风险、数据溯源缺失以及开放权重许可雷区。为实现安全且可持续的AI部署，企业必须从确定性软件思维转变为全面的全生命周期特性表征，并由AI从业人员、IT运维和法律合规组成的核心三位一体架构提供支撑。归根结底，企业需要建立集中的策展与治理中心来管理依赖项、模型权重和边缘部署，而不能寄望于一厢情愿。 现代企业级 AI 建立在 20 年未解决的技术债务之上，迫使组织必须全面掌握复杂的数值软件、高性能运行时以及应对高并发波动的硬件环境。 (2:01) 生成式 AI 和“氛围编码”（vibe coding）使得非技术人员构建软件的规模扩大了十倍，但这些人员往往缺乏基础的安全规范，导致企业受攻击面剧增。 (8:23) 企业 AI 的成功取决于 AI 从业者、IT/运维以及法律合规三方的紧密协作，组织的实际落地能力将严格受限于这三者中最薄弱的环节。 (3:26) 数据科学从业者长期存在直接向企业设备下载开源依赖的安全盲区，而公共软件包索引如今还面临国家级威胁与恶意 LLM 生成代码的严重冲击。 (10:50) 开源权重模型在许可协议与安全性上存在巨大隐患，企业必须建立专属的卓越中心与模型策展机制，以支持混合云及边缘设备的合规部署。 (21:18)

Anaconda co-founder Peter Wang argues that enterprise AI rests on decades of unresolved technical debt in scientific computing, requiring organizations to shift their operating focus from rapid code generation to rigorous characterization, software supply chain security, and data governance. The Post-SDLC Shift and the Triad Bottleneck (3:26) Traditional software development lifecycles (SDLC) assume deterministic systems, but machine learning models and autonomous agents behave probabilistically. Drawing an analogy to semiconductor manufacturing—where substantial capital goes into testing, electrical validation, and software characterization rather than basic fabrication—Wang states that writing code has become trivial, while characterizing edge cases, security, and runtime reliability is now the primary cost driver. Python's Chimeric Nature and Supply Chain Blind Spots (6:36) Python challenges conventional corporate IT governance because it serves interchangeably as a scripting tool, an application backend, and a wrapper around low-level C/C++ numerical libraries. IT departments frequently miscategorize data practitioners as standard software engineers, attempting to enforce ill-fitting developer controls while leaving package acquisition unmonitored. Consequently, practitioners routinely fetch dependencies from public repositories like PyPI, Conda, and CRAN directly onto local endpoints outside corporate procurement. Adversarial Exploits and Dependency Explosion (10:50) Standard data science imports automatically pull deep trees of hidden, transitive dependencies, exposing internal perimeters. Wang reports that threat actors and nation-state groups are actively targeting these repositories by submitting LLM-generated packages containing deliberate vulnerabilities. In response, major financial institutions such as JPMorgan Chase have issued mandates to software vendors demanding verifiable provenance. This exposure is magnified by non-technical workers adopting tools like ChatGPT and Claude to write scripts, multiplying internal creators without security hygiene. Data Provenance Failures and Vector Database Vulnerabilities (14:11) Because leading AI labs have largely halted public disclosure of training corpora over copyright liabilities, enterprises deploy foundation models with minimal insight into their training data. This lack of transparency interacts dangerously with model memorization limits, documented around 3.6 bits per parameter. Furthermore, naive retrieval-augmented generation (RAG) deployments face inversion threats: researchers have demonstrated that attackers can use a known reference dataset to compute coordinate transformation matrices against black-box vector databases, reconstructing plain-text personally identifiable information. Open-Weight Licensing Traps and Hub Security (18:19) Deploying open-weight models introduces unresolved compliance and security risks that lack the mature legal protections established by the Free Software Foundation or Open Source Initiative. Licenses like OpenRAIL and Copyfair variants pose policy hazards that enterprise legal teams cannot readily evaluate. Concurrently, public model hubs host serialized checkpoints and untrusted fine-tunes that can harbor malicious embedded code or toxic weights. Wang contends that mitigating these risks requires internal centers of excellence that govern data, audit licenses, and benchmark models for heterogeneous targets like edge fleets. Securing sustainable enterprise AI requires cross-functional alignment across data science, platform IT, and corporate compliance. Wang warns that enterprises cannot expect frontier AI research labs to deliver technical breakthroughs that eliminate these structural operational, legal, and supply chain responsibilities.

Anaconda 联合创始人兼首席 AI 创新官 Peter Wang 指出，现代企业 AI 并非孤立的技术飞跃，而是建立在长达 20 年未解决的开源科学计算与基础设施技术债务之上。他认为，随着生成式工具催生出大量非专业构建者，企业无法寄望外部模型突破消除操作瓶颈，必须将重心由单纯的代码生成转向测试、系统表征以及跨职能的全面治理。 历史技术债务与半导体模式的治理转向 (2:01) 现代 AI 炒作掩盖了一个严峻现实：前沿 AI 系统底层依赖大量复杂、脆弱甚至已被遗弃的遗留开源代码。Wang 强调，部署企业级 AI 并没有绕过传统的 IT 痛点，反而要求组织必须补齐过去 20 年在高性能数值软件、硬件突发算力调度以及非专业人员安全规范方面的短板。传统的软件开发生命周期（SDLC）针对确定性逻辑设计，根本无法应对机器学习模型和自主智能体的概率性行为。 为此，Wang 引用了半导体工业的投资结构作为类比：晶圆制造固然耗资数亿美元，但行业的大量资本实际流向了复杂的电气验证与软件表征测试，以确保芯片在物理世界可靠运行。同理，AI 系统的代码编写正变得高度轻量化，而最昂贵、最具挑战性的工作在于对系统边界情况、可靠性与安全性的全方位表征。企业必须协同 AI 研发团队、IT 平台运维以及法务合规部门，任何一处短板都会成为整个系统的吞吐瓶颈。 Python嵌合体特性与端点供应链失控 (6:36) 在企业 IT 治理中，Python 经常打破传统的管理认知。Wang 将 Python 形容为一种“嵌合体”（chimeric）技术：在不同用户手中，它分别承担着自动化脚本、异步 Web 后端，以及底层 C/C++ 高性能数值计算包装器这三种截然不同的角色。企业 IT 运维部门经常机械地将数据分析师归类为传统软件工程师，试图对其施加不适宜的僵化合规流程。 与此同时，以 ChatGPT、Claude 和 Claude Code 为代表的工具引发了“氛围编码”（vibe coding）风潮，使企业内部缺乏基础安全意识的开发者数量激增十倍。数据科学家与非技术人员为了实验，习惯直接在工作站拉取公开仓库代码，绕过了正式的企业采购与审计流程。企业高层往往在意识到成千上万台员工笔记本电脑都在直接调用外部未审核包时，才惊觉内部核心数据和个人身份信息（PII）正暴露在巨大的安全敞口之下。 隐式依赖膨胀与国家级软件供应链威胁 (10:50) 在数据科学工作流中，即便调用 NumPy、SciPy、Pandas、Scikit-learn 或 TensorFlow 等常见基础库，也会在底层引入庞大且复杂的隐式依赖链（transitive dependencies）。从业者不断新建虚拟环境进行探索，导致企业的安全暴露面呈指数级扩张。Wang 直言，传统的漏洞扫描往往属于事后告警，当前多数企业自知仅覆盖了 20% 至 30% 的实际供应链风险，这种被动防御在当前威胁环境下已难以为继。 开源生态目前正遭受黑客组织与具有国家背景的威胁实体的严重侵扰。攻击者正利用大语言模型批量构造含有隐蔽漏洞的恶意包，以此对公共代码仓库实施投毒并渗透企业下游。这种严峻形势促使摩根大通（JPMorgan Chase）等大型金融机构向软件供应商发布公开信，强制要求落实不可妥协的供应链可溯源标准。Anaconda 目前正通过为全球超过 10,000 家企业客户提供经过加固和策展的受控环境，协助机构阻断对公共仓库的直接依赖。 数据治理缺失、模型记忆与反演攻击风险 (14:11) 在底层软件之外，企业数据治理在 AI 时代出现了严重倒退。Wang 指出，基座模型的推理逻辑与向量空间完全由其训练数据决定，但前沿实验室为了规避版权诉讼已停止披露语料细节，使模型在数据层面沦为黑盒。而在企业内部，团队往往只是将非结构化数据倾倒入 Amazon S3 存储桶并附上简略说明，彻底丢失了传统数据仓库的治理严谨性，导致模型失效归因和合规追溯极为困难。 实证研究表明，大型模型具有约 3.6 比特/参数的记忆密度。更危险的是，近期针对检索增强生成（RAG）系统的研究显示，黑盒向量数据库极易遭遇坐标变换反演攻击：攻击者仅需利用已知样本构建平行向量空间，即可计算出变换矩阵，将目标系统中的未知向量逆向还原为敏感文本与原始 PII。为此，Wang 呼吁建立“再生创新公地”（regenerative innovation commons），并正与 Creative Commons 及 Common Crawl 等组织合作构建可持续的数据标准。 开源权重许可陷阱与全生命周期策展平台 (18:19) 为了规避云端供应商锁定，许多企业倾向于采用开源权重模型，但这些模型脱离了自由软件基金会（FSF）与开源倡议（OSI）沉淀数十年的法律先例。深入研读如 OpenRAIL 或 Copyfair 等模型协议，会发现大量可能导致违规的严苛商业条款。此外，公共模型社区（如 Hugging Face）的安全隐患远超传统代码库，包括权重文件中夹带的恶意执行代码、未经验证的量化版本，以及权重内部预埋的投毒内容。 为了在混合云、本地机房以及无人机、机器人等边缘异构设备上安全部署模型，企业必须建立卓越中心（Center of Excellence）主导的准入审计机制。Anaconda 正在推出集成模型策展与治理中心的企业级平台，将模型生命周期控制与底层 Python 软件包治理打通，并提供硬件基准评估与量化工具，帮助缺乏昂贵 GPU 资源的团队在受控状态下实现高频模型交付。 Wang 总结指出，企业在过去 17 年的技术演化中已经证明，AI 规模化落地无法通过走捷径或寄望外部技术突破来实现。随着 Python 成为企业 AI 的核心支柱，管理层必须告别侥幸心理，通过建立覆盖数据血统追溯、软件供应链加固与跨环境模型策展的工程化防线，才能化解历史技术债务带来的系统性崩溃风险。

## Background 本视频由 Ai4 于 2025 年 8 月 24 日发布在 YouTube 平台上。视频简介指出，Anaconda 联合创始人兼首席 AI 创新官 Peter Wang 在演讲中探讨了如何构建可持续的企业级 AI 基础设施，分享了在保障安全治理与避免云厂商锁定的同时，支撑企业规模化创新并控制技术债务的架构原则与战略框架。 ## TL;DR Peter Wang 深入剖析了企业在拥抱 AI 浪潮时被忽视的底层工程与治理危机。他指出，现代尖端 AI 实际建立在庞大且脆弱的开源 Python 遗留软件之上，大模型生成代码（Vibe Coding）的泛滥进一步加剧了企业软件供应链的投毒与泄密风险。与此同时，数据治理缺失、RAG 向量逆向提取攻击以及开源权重模型的许可证合规陷阱，正在让企业暴露在巨大的安全隐患中。他强调企业不能抱有侥幸心理，必须通过统一的模型目录、严密的数据治理底座与端到端开源审计，以全局系统工程的视角构建可持续的 AI 基础设施。 ## Atmosphere & style 整场演讲节奏紧凑、快人快语，Peter Wang 以极具亲和力的幽默感化解了现场时间被压缩的突发状况，迅速切入硬核技术痛点。他的叙事风格坦诚而辛辣，频繁用“对着威士忌哭出来”、“大家都在胡乱搞所以都要倒大霉”等接地气的生动比喻揭露行业盲目追逐大模型的治理乱象，带给听众既引人发笑又充满危机感的清醒震撼。 ## Key takeaways - [00:04](https://www.youtube.com/watch?v=yrjM2jH9n4o&t=4s) Anaconda 十余年来持续资助并孵化 JupyterLab、pandas 等核心项目，长期扮演着开源社区与企业商业化计算平台之间的桥梁角色。 - [02:01](https://www.youtube.com/watch?v=yrjM2jH9n4o&t=121s) 尖端 AI 系统实际上构建在大量甚至被废弃的遗留软件（Legacy Software）之上，企业扩展 AI 并非依赖新魔法，而是要解决 20 年来遗留的复杂数值计算与非专业工程治理难题。 - [03:26](https://www.youtube.com/watch?v=yrjM2jH9n4o&t=206s) 类比半导体芯片制造与测试，AI 代码编写仅是起点，企业在系统监控、性能表征（Characterization）及合规测试上的资源投入将远超编写成本，传统 SDLC 亟待重构。 - [06:36](https://www.youtube.com/watch?v=yrjM2jH9n4o&t=396s) Python 兼具运维脚本、Web 后端与高性能 C++ 胶水语言的“嵌合体”特征，导致企业 IT 容易出现认知错位，无法以传统工程标准有效治理数据科学工作流与开源风险。 - [08:23](https://www.youtube.com/watch?v=yrjM2jH9n4o&t=503s) 大模型催生了大量非专业人士进行“氛围编码（Vibe Coding）”，成倍放大了直接从公共仓库随意拉取第三方包的现象，企业终端已沦为缺乏可见性的软件供应链高危盲区。 - [12:12](https://www.youtube.com/watch?v=yrjM2jH9n4o&t=732s) 开源软件供应链已成为国家级黑客等恶意行为者的核心攻击矢量，企业需认识到漏洞扫描与局部补丁治标不治本，供应链安全已成为不可妥协的底线。 - [14:11](https://www.youtube.com/watch?v=yrjM2jH9n4o&t=851s) 模型是大规模数据的镜像反射；研究表明模型具有参数记忆容量（约 3.6 bits/parameter），攻击者甚至可通过旋转矩阵对比，直接从未知的 RAG 向量数据库中逆向提取出敏感 PII 数据。 - [16:46](https://www.youtube.com/watch?v=yrjM2jH9n4o&t=1006s) 许多团队处理 AI 数据集仍停留在粗暴上传 S3 存储桶的原始阶段，缺乏传统数仓的规范治理，未来需联合开源力量构建可持续的“再生创新公地”。 - [18:19](https://www.youtube.com/watch?v=yrjM2jH9n4o&t=1099s) 开放权重模型（Open-weight Models）的许可协议（如 OpenRAIL、CopyFair）极其复杂模糊，且公共模型权重大多缺乏安全审计，极易潜藏投毒代码与知识产权合规隐患。 - [21:18](https://www.youtube.com/watch?v=yrjM2jH9n4o&t=1278s) 企业亟需建立统一的模型策展中心（Model Catalog）与卓越中心机制，将模型治理与底层 Python 软件栈打通，以适配本地、私有云乃至边缘端（无人机、机器人等）量化模型的敏捷迭代。 - [23:56](https://www.youtube.com/watch?v=yrjM2jH9n4o&t=1436s) 企业在 AI 落地中必须保持“智识上的诚实”，切勿抱有盲从跟风的侥幸心理，而应从软件供应链、数据管理到模型合规自上而下构建全局受控的 Python 基础设施底座。 ## Detailed walkthrough ### [00:04](https://www.youtube.com/watch?v=yrjM2jH9n4o&t=4s) 演讲开场与 Anaconda 的开源生态积淀 演讲伊始，Peter Wang 带着些许幽默向听众道出了一个小插曲：他原以为自己有整整 45 分钟的演讲时间，直到临上场才发现主办方安排的实际时长仅有 20 到 25 分钟。他笑称这完全是自己的疏忽，绝不怪罪大会方，因此他不得不删掉演讲中间的一部分内容，并加快语速切入主题。他热情地邀请现场听众在会后前往展厅的 Anaconda 展台继续深入探讨相关技术细节。 随后 Peter Wang 正式介绍了自己的身份——Anaconda 联合创始人兼首席 AI 创新官（Chief AI Innovation Officer）。他回顾道，在过去的 12 到 13 年间，Anaconda 始终处于构建 Python 数据科学这一庞大生态的核心位置，全力推动 Python 成为企业内部合规、高效且极具商业价值的数据计算与分析基石。在这十余年中，Anaconda 将大量商业利润重新反哺给开源社区。许多开发者熟知的核心工具背后都有 Anaconda 的深度参与：他们孵化了 JupyterLab，至今仍是经典版 Jupyter Notebook 的维护者，并长年资助诸如 pandas、scikit-learn 等基础项目。如今，Anaconda 仍在持续投资能够简化部署、优化 Python 开发者及 AI 工程师体验的下一代技术，充当着开源社区与各行业企业客户之间至关重要的“桥梁”。 - Anaconda 在过去 12 至 13 年间持续将利润反哺开源生态。 - 孵化了 JupyterLab，持续维护经典版 Jupyter Notebook，并长期赞助 pandas 与 scikit-learn。 - 深度参与编译器技术、可视化工具研发，并作为受信赖的 Python 运行时内置于众多主流企业级计算平台中。 --- ### [02:01](https://www.youtube.com/watch?v=yrjM2jH9n4o&t=121s) 尖端 AI 背后的“脏活”：跑在被遗忘的遗留代码之上 谈及当前的 AI 浪潮，Peter Wang 指出行业内存在一个常被忽视但致命的现实：尽管人工智能被所有人视为当下最前沿的热点和未来的技术基石，但整个 AI 架构实际上“是由大量的遗留软件（Legacy Software）组成并构建在其之上的”。这些底层代码很多是几乎无人愿意触碰的“陈年旧账”，甚至早已处于被原始维护者放弃的状态。 因此，谈到企业该如何构建并扩展 AI 解决方案时，他抛出了一个兼具“好消息与坏消息”的论断：企业不需要发明全新的魔法，只需要在“过去 20 年里一直做得很烂的事情上重新做好”。这包括部署复杂的数值计算软件、支撑硬件开销极具突发性（bursty）的高性能计算任务，以及最棘手的一点——必须把这套基础设施开放给完全没有正规软件工程背景的人群。他形象地对比道，过去企业面临的是数据科学家不知道如何用 Docker、经常从互联网上直接 `sudo install` 各种乱七八糟包的治理乱象；而现在问题被放大到了全新规模，甚至演变成“营销副总裁在用大模型进行氛围编码（vibe coding）写 Python”。底层的治理与运维难题本质上完全一致，只是规模和参与者的非专业程度被剧烈放大了。 --- ### [03:26](https://www.youtube.com/watch?v=yrjM2jH9n4o&t=206s) 重构生命周期：从芯片晶圆测试看 AI 系统的治理与表征 针对客户、投资者及企业领袖最常提出的疑问——“究竟什么会取代传统的软件开发生命周期（SDLC）来支撑 AI 应用？”，Peter Wang 提出了系统层面的全新思考。他认为，AI 信息系统必须以更全局、更系统化的视角来进行管理。在传统软件领域，虽然大家口头上重视测试，但往往只是走个过场；而在 AI 时代，企业在测试、监控、性能表征（characterization）以及合规治理上所投入的资源与资金，注定将与编写代码本身相当，甚至远远超出开发成本。 为了形象地说明这一点，他以半导体制造业进行了类比：在硅晶圆上设计和制造芯片本身确实耗资巨大，但晶圆下线仅仅是整个工序的开端。半导体行业后续需要斥巨资采购测试设备，开展详尽的电气性能表征与软件适配测试，最终合格的芯片才能装入真实计算机中使用。AI 系统同样如此，“编写代码反而是相对容易的部分”，如何对其进行性能与行为特征刻画、验证其输出符合预期，才是真正需要大量资源投入的重头戏。他强调，无论底层模型如何演进，“明天 Anthropic 也绝不可能发布一篇让这些工程与合规难题瞬间消失的论文”，企业必须正视开源管理、算力部署以及法律合规的三重现实。 ```mermaid flowchart TD accTitle: 半导体制造与 AI 系统生命周期对照 subgraph Semi["半导体制造体系"] S1["硅晶圆芯片设计与制造"] --> S2["严苛测试与电气/性能表征"] S2 --> S3["最终交付可用计算芯片"] end subgraph AI["现代 AI 工程生命周期"] A1["模型构建与代码编写 (相对轻量)"] --> A2["系统监控、行为表征与治理测试 (重金投入)"] A2 --> A3["企业级安全合规落地"] end ``` - 传统 SDLC 无法完全套用在 AI 系统上，系统的“表征与评估”成本将远超“编写”成本。 - 业务成功取决于三维一体的能力：AI 算法团队、IT 与运维基础设施团队、业务与法律合规团队；任意一环脱节都会导致系统崩盘。 - 不存在任何大模型厂商的单点技术突破可以免除基础设施与合规治理的工程代价。 --- ### [06:36](https://www.youtube.com/watch?v=yrjM2jH9n4o&t=396s) AI 治理第一关：Python 的“嵌合体”特征与开源管控困局 进入演讲的第一部分——“如何为 AI 治理开源软件”，Peter Wang 尖锐地指出，在他过去 15 年的观察中，大多数企业在管理开源软件方面普遍表现不佳，而面对 Python 时更是进退失据。这种困境很大程度上源于 Python 独特的“嵌合体”（chimeric）特征：它既能像 Bash 那样充当 IT 人员随手编写的自动化运维脚本，又能像 Ruby 或 Node.js 那样构建 Web 后端，还可以作为胶水语言包裹底层 C++ 编写的极致数值计算库。 这种多面性在企业内部造成了严重的治理认知错位。当 IT 部门看到数据科学团队在 Jupyter Notebook 或 VS Code 中写 Python 时，往往会想当然地将他们当成普通的软件工程师，试图强行套用传统软件开发生命周期（SDLC）的管理规范，而这恰恰与数据探索的实际工作流背道而驰。更严重的问题出在安全与法律合规层面：尽管企业日常大量使用 Linux、Nginx 等成熟开源基础组件，但企业法务和合规团队在面对 Python 生态时往往大为震惊——他们难以想象任何一个初级员工都可能随手从公网拉取成千上万个未经审计的第三方代码包，瞬间给整个组织带来巨大的知识产权和法律风险暴露。如今在“人人借助 AI 氛围编码（vibe coding）”的新常态下，这种未受管控的代码引入风险变得愈发严峻。 ### [08:23](https://www.youtube.com/watch?v=yrjM2jH9n4o&t=503s) 终端上的开源失控与企业软件供应链的“狂野西部” 在数据科学和 AI 开发领域，Python 与 R 作为极受欢迎的开源语言生态系统，其安装和运行方式正给企业 IT 治理带来巨大的盲区。开发人员与数据科学家通常将这些环境直接安装到个人工作站或 Linux 研究工作机上。虽然这些设备名义上仍在 IT 治理的范畴内，但由于它们脱离了受严格管控的传统软件开发流程，企业对这些设备上发生的事情往往丧失了可见性。Peter Wang 戏谑地分享道，Anaconda 接触过无数客户，管理层的典型反应往往是：“这个叫 Python 的东西到底是什么？为什么我们公司里有一万台笔记本电脑都装了它？”这种现象对技术圈内人来说既荒谬搞笑，但对企业而言却带着一丝悲剧色彩——整个业务极度依赖一套极其强大、不可或缺的工具，而企业管理层甚至根本不知道它的存在。 ```mermaid flowchart TD accTitle: 企业开源与 AI 软件供应链风险流 subgraph DevSpace["开发者 / Vibe Coding 终端"] A["开发者 / AI 辅助编程<br>(ChatGPT / Claude Code)"] --> B["生成并执行 Python 代码"] B --> C["从公共仓库随机拉取包<br>(CRAN / PyPI / Conda)"] end subgraph RiskDomain["企业安全隐患"] C --> D["依赖项爆炸<br>(NumPy / SciPy / scikit-learn 等)"] D --> E["供应链攻击与恶意投毒<br>(国家黑客 / LLM 生成代码漏洞)"] E --> F["触及客户数据 / PII 泄露"] end subgraph Governance["传统治理失效"] G["传统 IT 采购流程<br>(严重缺乏终端可见性)"] -.->|无法覆盖| C end ``` 这种随意从 CRAN、PyPI 或 Conda 等公共仓库拉取软件的做法，在开发者眼中就“像呼吸一样自然”，但在传统企业软件采购与生命周期管理的视角下，这完全是“不可理喻的疯狂”（absolute craziness）。开发者随意引入的公共包极有可能接触到企业内部的敏感客户数据甚至个人身份信息（PII）。更严重的是，随着 ChatGPT、Claude 以及 Claude Code 等大模型代码生成工具的普及，催生了大量“AI Vibe Coding”人群。Peter Wang 直言，这些凭借 AI 直觉写代码的人在软件安全意识上“绝不会比数据科学家强到哪儿去”。大模型疯狂吐出 Python 代码，代码又自动下载各种第三方依赖，导致企业内部的“实质开发者”数量瞬间激增 10 倍，各种未经审查的软件在终端野蛮生长。 - 即使是最基础的现代 AI 或数据任务（如仅导入 `numpy`、`scipy`、`pandas` 或 `scikit-learn`、`streamlit`、`tensorflow`），底层引入的间接依赖项数量也是极其庞大的（astronomical）。 - 企业现阶段采取的手动包管理、局部审核或后期扫描方案治标不治本；漏洞扫描往往只是在系统“已经被攻破或出问题之后”给出警报。 - 绝大多数企业心知肚明，自己在软件供应链安全上所做的措施“仅达到实际所需防护力度的 20% 到 30%”。 --- ### [12:12](https://www.youtube.com/watch?v=yrjM2jH9n4o&t=732s) 开源供应链攻击升级与摩根大通的强硬立场 如果在六七年前纯粹的数据科学时代，这种 20%~30% 的防御松懈度还能勉强维持，那么在 AI 技术飞速发展的当下，供应链安全风险正在急速变成严酷的现实。全球的黑帽黑客团队以及国家级背景的恶意行为者（sovereign state actors）已经敏锐意识到，开源软件供应链是对全球企业发动攻击的“绝美且强大的攻击矢量”（an incredibly beautiful and powerful vector）。Python 开源社区的基础设施目前正承受着前所未有的压力与冲击，网络上充斥着海量由大模型自动生成的代码仓库与项目，其中不少暗藏精心设计的恶意代码片段，专门用于渗透企业代码库。 面对日益严峻的威胁，头部金融机构已经率先采取强硬措施。摩根大通（JPMorgan Chase）向其所有第三方软件供应商发布了一封公开信，明确通告其必须全面加固并保障自身软件的安全，强硬表态“安全绝对是不可妥协的底线”。这表明全球最大的技术驱动型组织已经看清了未来的威胁趋势。Peter Wang 表示，Anaconda 的核心目标就是确保企业能够规模化、安全顺畅地采用 Python 生态，避免随意拉取到损坏或投毒的开源组件，其相关解决方案目前已服务超过 10,000 家企业客户。 --- ### [14:11](https://www.youtube.com/watch?v=yrjM2jH9n4o&t=851s) 数据治理危机：模型记忆机制与 RAG 向量反向提取攻击 当企业理顺了软件供应链与管理技术栈之后，紧接着面临的核心挑战便是**数据治理**。Peter Wang 强调，尽管业界整天充斥着对前沿大模型版本（如 GPT-5 的讨论）的追逐与狂热，但本质上“脱离了数据，模型什么都不是”（the models are nothing without the data）。大模型仅仅是其训练数据的镜像反射，数据的质量、结构以及训练的具体流程直接决定了最终向量嵌入（embedding vectors）的分布与模型的推理能力。然而，当前业界的数据集管理现状却是一场“彻底的灾难”——早期研究机构还会公开发布训练数据集，后来因为数据问题过于混乱且惧怕侵权诉讼，便索性停止公开。 这种数据溯源（data provenance）与治理的缺失，正给企业实际应用带来巨大的安全隐患。Peter Wang 列举了近期顶尖学术研究揭示的严重风险： - **模型记忆容量（Memorization Capacity）**：研究表明大语言模型存在固有的记忆特性，其参数记忆容量可达到约 3.6 bits/parameter。 - **RAG 向量数据库逆向投影攻击**：在近几个月内发表的一项突破性研究中，攻击者在对目标 RAG（检索增强生成）嵌入数据库源数据完全一无所知的情况下，通过利用自己已知源数据的另一套数据库进行比对训练，成功计算出一个旋转/变换矩阵（rotation or transformation matrix）。利用该矩阵，攻击者能够直接从目标 RAG 向量数据库中逆向提取出特定的 PII 与被记忆的敏感数据。 对于那些早已在生产环境中部署了 RAG 系统的企业与开发者而言，这意味着巨大的暴露面已经形成，若缺乏严密的数据资产治理与防御策略，企业将陷入被动应对数据泄露危机的困境。 ### [16:46](https://www.youtube.com/watch?v=yrjM2jH9n4o&t=1006s) 数据集的治理误区与 AI 再生创新公地 在企业实际落地 AI 模型的过程中，数据集的处理方式普遍存在严重的短板。许多团队在对待 AI 数据集时，依然没有采取传统企业级数据管理（如数据库、数据仓库）那种严谨的治理标准。尽管传统数据仓库的流程有时显得繁琐笨重（clunky），但如今很多团队只是简单地“把文件往 S3 Bucket 里一扔、打个标签、塞一份 Readme 文件”，这种粗糙的操作方式根本无法应对日益复杂的合规与技术挑战。 关于这一议题，Peter Wang 提到了自己在哈佛大学发表的一场演讲，并附带了由 Chrome 生成、带有标志性小恐龙图案的二维码。该演讲深入探讨了底层训练数据（涵盖 GPT、Gemini 以及各类公共数据集与网络抓取数据）背后的法律与技术基础。这不仅触及开源哲学，更延伸到他构想中的“再生创新公地”（Regenerative Innovation Commons）愿景。彼得提到，今年秋季他将联合 Creative Commons、Common Crawl 等多家全球知名机构，正式发布关于这一项目的更多信息。 - **传统数据治理 vs. 现实落差**：企业在应对数据库与数仓时已有成熟体系，但在 AI 数据集上往往流于形式，仅靠简单的 S3 存储桶加 Readme 无法支撑严谨的生产需求。 - **合作生态网络**：正在联合 Creative Commons、Common Crawl 等组织共同探索未来开放且可持续的 AI 创新数据底座。 --- ### [18:19](https://www.youtube.com/watch?v=yrjM2jH9n4o&t=1099s) 开源权重模型的合规陷阱与安全威胁 当企业跨过了数据管理的基本门槛，接踵而来的难题便是如何管理模型本身。目前大部分企业的实际状态非常混乱：一段代码放在 GitHub，几个容器镜像存在 Docker Hub，散落各处的脚本，以及某台服务器上跑着的某个 Jupyter Notebook。这种缺乏统一 AI 平台与模型目录系统（Model Catalog）的拼凑式架构，给企业带来了巨大的合规与安全漏洞。 ```mermaid flowchart TD accTitle: 模型合规与安全风险链条 subgraph S1["公共源风险 (Public Repos)"] A["Hugging Face / 公共仓库"] --> B["混杂许可证 (OpenRAIL, CopyFair 等)"] A --> C["恶意投毒 / 恶意代码 / 敏感内容"] end subgraph S2["企业治理网关 (Enterprise Governance)"] B --> D["许可证审查与法律合规校验"] C --> E["模型微调与量化版本安全审计"] D --> F["内部模型目录与策展中心 (Model Catalog)"] E --> F end subgraph S3["多端安全部署 (Deployment)"] F --> G["本地 / 混合云 / 边缘设备 (无人机、机器人)"] end ``` 在模型合规方面，开放权重模型（Open-weight Models）的许可协议现状堪称“狂野西部”（Wild West）。彼得打趣道，如果大家今晚参加完社交活动，“端着一杯威士忌坐下来，仔细研读 Hugging Face 上你最喜欢的模型的许可证条款，你可能会对着威士忌哭出来”。很多模型微调时引入了 CopyFair 等复杂协议，或采用了 OpenRAIL 等带有限制性条款的许可证。虽然开源软件领域经过自由软件基金会（FSF）和 OSI 几十年的发展已经建立起安全的法律避风港，但 AI 模型的法律合规界限仍旧模糊不清，企业法务一旦核查，往往会得出无法合规的结论。 此外，模型安全更是迫在眉睫的危机。公共模型仓库（如 Hugging Face）中潜藏的供应链安全风险远比 PyPI 等公共软件代码仓库更加严峻。攻击者可能在模型微调权重、量化版本中植入恶意代码，甚至混入极其不当的敏感内容。一旦这些未经验证的模型被直接接入面向客户的聊天机器人，将引发灾难性的业务与声誉危机。 --- ### [21:18](https://www.youtube.com/watch?v=yrjM2jH9n4o&t=1278s) Anaconda 的模型治理平台与边缘计算落地 面对上述危机，企业必须建立内部的合规与策展机制（Compliance and Curation Scheme），通过卓越中心（Center of Excellence）扮演全企业的守门人、策展人与审计者角色。针对这一普遍诉求，Anaconda 正在其 AI 平台中推出专用的模型策展与治理中心，使不同团队能够协同管理引入的模型、执行合规控制，并在统一的内部环境完成从本地笔记本、私有云、混合云到边缘端的多场景部署。 在边缘计算场景中（如无人机、机器人、各类传感器平台），工程师需要频繁迭代经过高度量化（Quantization）的超轻量模型。这类边缘部署在高度依赖云端大模型的传统基础设施下极为痛苦，而 Anaconda 从底层架构设计之初便全面兼顾了边缘设备及机群（Fleet/Field Deployments）的快速迭代与部署需求。 - **多端与边缘支持**：系统原生优化本地轻量运行与边缘端设备支持，解决无人机、机器人等硬件对量化模型的迭代瓶颈。 - **性能与成本权衡可视化**：平台界面提供直观的指标评估，帮助企业在缺少英伟达 H100 等高端算力硬件时，针对低配置硬件进行量化与推理优化。 - **软件与模型双重治理**：模型治理模块与 Anaconda 既有的开源软件治理底座直接打通，确保模型运行所依赖的底层 Python 包和开源软件栈同样符合企业级安全基准。 --- ### [23:56](https://www.youtube.com/watch?v=yrjM2jH9n4o&t=1436s) 告别侥幸心理：以全局视角构建企业级 Python 与 AI 底座 Peter 总结道，在企业级 AI 的落地与安全治理上，必须保持“智识上的诚实”（Intellectually Honest），将其视作一个不可分割的全局系统工程。虽然数据治理、软件供应链安全、模型合规与边缘部署等各个环节都是长期存在的硬骨头，但企业绝不能抱有侥幸心理。 > “不要抱有‘反正大家都是这么干的，肯定没问题’的幻想——事实是，所有人都在这么胡乱搞，所以所有人都要倒大霉（Everyone's doing that and everyone is screwed）。如果你想独善其身，就必须保持极其清醒和自觉的规划。” 即便企业当下还没有完全启动大规模生成式 AI 项目，只要管理层终于意识到“公司内部存在大量的 Python 代码，且未来的 AI 战略完全依赖于 Python”，Anaconda 就能帮助企业解决如何在企业级规模下安全、合规地部署和治理 Python 基础设施这一根本痛点。 ### [24:55](https://www.youtube.com/watch?v=yrjM2jH9n4o&t=1495s) 长期实践经验与现场总结收尾 Peter Wang 回顾了自己在该领域的长期积累，指出在 12 年前创立 Anaconda 之前，他就已经在这类技术与架构问题上深耕了 5 年之久。因此，在与企业客户沟通这些核心痛点与挑战时，他有着极其丰富且深入的实践经验。 在结束演讲时，Peter 幽默地看了一眼时间并开玩笑问现场工作人员：“我超时了吗？如果超时了我是不是得请谁喝一杯？”在确认时间刚好用尽后，他表示现场虽然没有额外的时间留给提问环节，但非常欢迎参会者前往 Anaconda 的展台（Booth），团队非常期待与大家就企业 AI 基础设施、开源治理以及可持续创新等话题展开更深入的交流。 - **深厚经验积累**：在创立 Anaconda 之前的 5 年以及公司成立至今的 12 年里，团队一直致力于解决企业在数据科学与 AI 基础设施方面的实际难题。 - **展台交流邀请**：由于演讲时间结束无法进行现场 Q&A，Peter 邀请对相关话题感兴趣的观众前往现场展位做进一步沟通。 ## Notable quotes > [02:01](https://www.youtube.com/watch?v=yrjM2jH9n4o&t=121s) 由大量的遗留软件（Legacy Software）组成并构建在其之上的 — Peter Wang > [03:26](https://www.youtube.com/watch?v=yrjM2jH9n4o&t=206s) 编写代码反而是相对容易的部分 — Peter Wang > [03:26](https://www.youtube.com/watch?v=yrjM2jH9n4o&t=206s) 明天 Anthropic 也绝不可能发布一篇让这些工程与合规难题瞬间消失的论文 — Peter Wang > [08:23](https://www.youtube.com/watch?v=yrjM2jH9n4o&t=503s) 这个叫 Python 的东西到底是什么？为什么我们公司里有一万台笔记本电脑都装了它？ — Peter Wang > [12:12](https://www.youtube.com/watch?v=yrjM2jH9n4o&t=732s) 绝美且强大的攻击矢量（an incredibly beautiful and powerful vector） — Peter Wang > [12:12](https://www.youtube.com/watch?v=yrjM2jH9n4o&t=732s) 安全绝对是不可妥协的底线 — Peter Wang > [14:11](https://www.youtube.com/watch?v=yrjM2jH9n4o&t=851s) 脱离了数据，模型什么都不是（the models are nothing without the data） — Peter Wang > [18:19](https://www.youtube.com/watch?v=yrjM2jH9n4o&t=1099s) 端着一杯威士忌坐下来，仔细研读 Hugging Face 上你最喜欢的模型的许可证条款，你可能会对着威士忌哭出来 — Peter Wang > [23:56](https://www.youtube.com/watch?v=yrjM2jH9n4o&t=1436s) 不要抱有‘反正大家都是这么干的，肯定没问题’的幻想——事实是，所有人都在这么胡乱搞，所以所有人都要倒大霉（Everyone's doing that and everyone is screwed）。如果你想独善其身，就必须保持极其清醒和自觉的规划。 — Peter Wang > [24:55](https://www.youtube.com/watch?v=yrjM2jH9n4o&t=1495s) 我超时了吗？如果超时了我是不是得请谁喝一杯？ — Peter Wang ## Mentioned Peter Wang, Anaconda, JupyterLab, Jupyter Notebook, pandas, scikit-learn, Anthropic, Python, R, Bash, Ruby, Node.js, C++, Linux, Nginx, VS Code, CRAN, PyPI, Conda, ChatGPT, Claude, Claude Code, NumPy, SciPy, Streamlit, TensorFlow, 摩根大通 (JPMorgan Chase), GPT-5, GPT, Gemini, Creative Commons, Common Crawl, Hugging Face, Docker Hub, OpenRAIL, CopyFair, FSF (自由软件基金会), OSI (开放源代码促进会), 英伟达 H100 ## Video description Peter Wang, Co-founder & Chief AI Innovation Officer, Anaconda Abstracts As AI adoption accelerates across industries, many organizations face critical infrastructure challenges that limit their ability to scale effectively and deliver measurable business value. Peter Wang, CAIO and co-founder of Anaconda, explores the architectural principles enabling sustainable AI innovation that grows with your business needs without corresponding increases in risk or technical debt. Drawing on lessons from pioneering open source ecosystem development, Peter will share strategic frameworks for building flexible AI systems that provide immediate value while maintaining governance as complexity grows. Leaders will gain insights into balancing security and innovation, avoiding hyperscaler lock-in, and creating an AI foundation that empowers practitioners while satisfying enterprise requirements. Book a demo with our team on site to discuss how these principles might apply within your organization's unique AI journey. [Source](https://www.youtube.com/watch?v=yrjM2jH9n4o)

[2:01] Peter Wang: 由大量的遗留软件（Legacy Software）组成并构建在其之上的 [3:26] Peter Wang: 编写代码反而是相对容易的部分 [3:26] Peter Wang: 明天 Anthropic 也绝不可能发布一篇让这些工程与合规难题瞬间消失的论文 [8:23] Peter Wang: 这个叫 Python 的东西到底是什么？为什么我们公司里有一万台笔记本电脑都装了它？ [12:12] Peter Wang: 绝美且强大的攻击矢量（an incredibly beautiful and powerful vector） [12:12] Peter Wang: 安全绝对是不可妥协的底线 [14:11] Peter Wang: 脱离了数据，模型什么都不是（the models are nothing without the data） [18:19] Peter Wang: 端着一杯威士忌坐下来，仔细研读 Hugging Face 上你最喜欢的模型的许可证条款，你可能会对着威士忌哭出来 [23:56] Peter Wang: 不要抱有‘反正大家都是这么干的，肯定没问题’的幻想——事实是，所有人都在这么胡乱搞，所以所有人都要倒大霉（Everyone's doing that and everyone is screwed）。如果你想独善其身，就必须保持极其清醒和自觉的规划。 [24:55] Peter Wang: 我超时了吗？如果超时了我是不是得请谁喝一杯？

[0:04] Peter Wang: at kind of a clip [2:01] Peter Wang: the good news and the bad news is you just have to get good at doing all the things that you have been bad at doing for the last 20 years. [2:01] Peter Wang: don't know why you should not just, you know, `sudo` install things from the internet. [2:01] Peter Wang: vibe code some Python [3:26] Peter Wang: There will not be some paper from Anthropic tomorrow that makes one of these things go away. This is just going to be part of your life from now on. [8:23] Peter Wang: What's this Python thing, and what do you mean it's installed on 10,000 laptops across our business? [8:23] Peter Wang: like breathing. [18:19] Peter Wang: you'll start crying into your whiskey because you're going to realize you're probably not in compliance. [18:19] Peter Wang: pale in comparison to the kinds of things that are happening on public model repositories like Hugging Face. [21:18] Peter Wang: everyone's doing that and everyone is screwed. [24:55] Peter Wang: Am I at time? Do I owe someone a drink running over?

[0:04] The really entertaining thing is I I [0:05] thought for whatever reason that I had a [0:07] 45minute talk. Turns out it's only 20 to [0:10] 25 minutes. And so this I'm not blaming [0:12] the conference. This is my own screw up. [0:13] So I'm going to talk really fast. No, [0:15] actually I cut out a middle part of the [0:16] talk, but I'll provide a reference to [0:18] some stuff in there. Um and I'm but I [0:20] will go at kind of a clip. If you guys [0:22] want to dig in on anything that I'm [0:23] talked about here, please come by our [0:25] booth. We're uh there's a nice Anaconda [0:27] booth on the show floor. I would love to [0:28] follow up and answer any questions. So, [0:30] let's get right to it. I am Peter Wang [0:32] and I'm the founder of Anaconda. I'm the [0:34] chief AI officer there. Um, for those [0:36] who are not aware, Anaconda as a company [0:38] uh was at the center of really creating [0:40] the Python data science ecosystem and [0:42] pushing the use of Python as a [0:45] legitimate and useful and good [0:47] technology within businesses for [0:48] business data computing, business data [0:50] analytics. Um and over the last I guess [0:53] 12 13 years we have put a lot of money a [0:57] lot of our um a lot of our profits we [0:59] put right back into investing in the [1:01] open source ecosystem. And so there's [1:03] obviously um any of you who use Anaconda [1:05] you're familiar with the package manager [1:07] tool but we actually have invested or [1:09] incubated a lot of other tools that you [1:11] may be familiar with. So we actually [1:13] incubated Jupyter lab. We are the [1:14] current maintainers of Jupyter notebook [1:16] classic. Uh we've funded projects like [1:18] pandas and scikitlearn and all these [1:20] things over the years. And right now [1:21] we're investing a lot of new uh Python [1:23] technologies that we hope will ease [1:25] deployment and ease the developer [1:26] experience for Python coders uh and data [1:29] scientists and AI engineers for many [1:31] years to come. So that's what we do and [1:33] we're very proud of the fact that we're [1:34] able to uh really be a bridge between [1:36] the community and all of the enterprise [1:38] users and customers of Python. Um and [1:42] this is born out by the fact that we [1:43] have many stakeholders and we're trusted [1:44] by a lot of enterprise um uh platforms [1:47] actually as the Python runtime inside [1:49] them. We also do a lot of technical [1:50] partnerships with with folks on things [1:52] like compilers and visualization [1:54] technology. Um it's been a really really [1:55] great um and really kind of fun ride to [1:58] have so many different kinds of [1:59] stakeholders that we get to play with. [2:01] Um, and all of this is just to say the [2:03] reason why I I could call call this out [2:05] is because there's something really [2:06] really important to know about this [2:08] current moment in AI and certainly in [2:10] the challenges we might have around the [2:12] enterprise deployment of AI and that's [2:15] that it's even though AI is the cutting [2:17] edge thing everyone's talking about as [2:19] the the current big thing and al obvious [2:21] obviously the next new thing coming um [2:23] the challenge is that AI really comp is [2:25] comprised of and sits on top of a lot of [2:28] legacy software and I mean a lot out of [2:30] it. Stuff that nobody really wants to [2:32] touch, stuff that is sometimes [2:34] abandoned. Um, so the interesting thing [2:36] then when we talk about how do we build [2:38] and scale, you know, enterprise AI [2:40] solutions. Well, the good news and the [2:42] bad news is you just have to get good at [2:44] doing all the things that you have been [2:45] bad at doing for the last 20 years. [2:47] That's that simple, right? You have to [2:48] deploy numerical software. You have to [2:50] run really performance intensive [2:52] software um with very bursty kinds of uh [2:55] hardware footprint. All these kinds of [2:57] things. Oh, by the way, you have to make [2:58] this infrastructure available to people [3:00] who are not software engineers who don't [3:01] know why you should not just, you know, [3:04] pseudo install things from the internet. [3:06] Right? So, we have the same problems [3:08] that we've always had in data science [3:10] and ML, MLOps, and all these things [3:12] except it's a much bigger scale. Uh, [3:14] because instead of a data scientist [3:15] trying to figure out how to do something [3:16] with Docker, it's maybe a VP of [3:18] marketing trying to vibe code some [3:20] Python, right? So, again, same problems [3:22] at a bigger scale. [3:26] Um, and and I'll just put the the sort [3:28] of the bottom line up front. The [3:30] question of what I actually think the AI [3:32] life cycle, dev life cycle will look [3:34] like. This I think this is a question I [3:35] hear a lot from customers and from [3:37] investors and and other folks um uh who [3:39] are really in the AI enterprise adoption [3:42] part of the world. Um, and the question [3:44] is what replaces the current software [3:46] development life cycle? How do we think [3:47] about AI applications? How do we think [3:48] about maintaining them, securing them, [3:50] governing them? And I think that [3:51] actually this is a very interesting [3:53] thing because the classic view of [3:54] software is changing has to change. [3:56] Actually that's kind of the point of my [3:58] whole talk is all the ways that it is [3:59] changing. Um but my answers first here [4:02] is that I think really we're going to [4:04] have to manage these AI applications [4:06] these information systems much more [4:08] holistically and we may end up having to [4:10] invest as much or more in the testing [4:14] and the u monitoring of these things and [4:16] the performance characterization as we [4:18] do in the actual development. And uh the [4:20] reason I have pictures of like wafers [4:22] and chips here is because that's another [4:24] part of the world where we have a deeply [4:26] technical product. It is a semiconductor [4:28] chip on a silicon wafer. Uh it takes a [4:30] tremendous amount of money to design and [4:32] make one of those things. And any of you [4:35] who are in semiconductors or know [4:36] anything about how chips are made, you [4:37] know that there is once you make the [4:39] chip, that's only the beginning of it. [4:41] There's so much money invested in test [4:43] equipment, software characterization, [4:45] performance, electrical characterization [4:47] before you go from the silicon wafer to [4:49] an actual chip that ends up in a in a [4:51] real computer somewhere. And I think [4:52] with our AI systems, it may be a similar [4:54] kind of thing where we have to actually [4:55] go and build out all this kind of [4:57] characterization and testing and [4:59] governance stuff, which you know, in the [5:01] software world, we've always kind of [5:02] cared about it, but let's be honest, [5:04] like that's a lot of it has been lip [5:06] service. With these AI systems, the [5:08] building out of the code may be somewhat [5:10] the simpler thing, but then [5:12] characterizing it and ensuring that it [5:13] does the right thing may be the part [5:15] that we have to put more money and time [5:16] into. Um, and so the question of how do [5:19] we adopt these AI technologies and AI uh [5:22] agents, you know, all these kinds of [5:24] things, how do we deploy them? How do we [5:25] govern them? Again, it has to be a very [5:26] holistic approach. And really there they [5:29] have a lot of similarities to classic [5:31] machine learning and data science kinds [5:32] of workloads. So we have to get good at [5:34] the same kinds of things that people [5:36] have been struggling with for now I [5:38] would say 10 years at least. Um and so [5:40] you have to be good at managing open [5:42] source software. You have to be good at [5:43] uh deploying scalable amounts of compute [5:46] on possibly your own on-prem hardware or [5:48] on clouds. Um and you have to navigate a [5:51] ton of compliance and legal issues. None [5:53] of these things are going to go away. [5:54] There will not be some paper from [5:56] anthropic tomorrow that makes one of [5:58] these things go away. This is just going [5:59] to be part of your life from now on. So [6:03] um at the end of the day, what is the [6:04] net net? It is that your AI capabilities [6:06] as a business, as an organization will [6:08] only be as good as you are at managing [6:10] the combination of these things. Which [6:12] means if you have a really really [6:14] awesome AI team, but your ops team and [6:16] your IT people don't know what's going [6:18] on, you will fail, right? Or if you have [6:20] a really good ops and and and AI team, [6:22] but you are not paying any attention [6:24] whatsoever to the business compliance [6:26] issues, you will fail. So this is just [6:28] the good news, bad news slide. Here's [6:30] the problem. Here's what we have to do [6:32] and I'm going to break this talk into [6:33] basically three parts that address each [6:34] of these different pieces. So the first [6:36] piece, how do we govern open source for [6:39] AI? Well, in general, what I've seen [6:42] over the last again 15 years or so that [6:45] I've been doing this, I've seen that [6:46] businesses, enterprises are really bad [6:48] at dealing with open source in general [6:49] and they really particularly struggle [6:51] with Python. And Python is in particular [6:53] problematic because it is kind of a [6:55] weird language. it's a scripting [6:56] language like uh like bash or or you [6:58] know it people know how to script stuff [7:00] with python or it's a web backend [7:02] development language like a ruby or a [7:03] node uh or you can use it to write [7:05] numerical stuff and wrap stuff like C++ [7:08] and so it has this like kind of very um [7:10] chimeic uh aspect which confuses it in a [7:14] lot of cases because when they see some [7:16] data scientist in the data science group [7:19] writing Python in a Jupyter notebook or [7:20] even in VS Code they're going to assume [7:22] they're a software engineer and they [7:24] should therefore be subject to all of to [7:25] the kinds of uh governance principles [7:27] that they apply to the software [7:28] development life cycle. But of course, [7:29] we know that's not how that should work, [7:31] right? Um and and furthermore, even [7:34] though many businesses, you would think [7:35] that they're really good at dealing with [7:36] open source because pretty much everyone [7:38] runs a lot of open source tools like [7:40] Linux, uh web servers, you know, [7:42] Node.js, a lot of front-end stuff. Um [7:44] the interesting thing about Python is [7:46] that it really from my perspective has [7:48] shown how bad enterprises outside of the [7:51] IT group are how bad they are at [7:54] understanding what open source really [7:55] means and how to really bring it in [7:56] house. So when we talk to legal and [7:59] compliance teams they'll often be [8:00] shocked at the fact that there are [8:01] hundreds of thousands of possible pieces [8:03] of code that some random junior person [8:06] could pull into the organization um and [8:08] cause them legal exposure. Right? So [8:10] these kinds of challenges exist except [8:12] now it's harder because you're going to [8:14] have people vibe coding these things. So [8:16] how do we get through this? Well the [8:18] general generally what an enterprise [8:19] sees is that you know again this is kind [8:21] of data scienceoriented. You have [8:23] Python, you have R very very popular [8:25] open source um languages and language [8:27] ecosystems for doing this kind of work. [8:29] They're going to get installed directly [8:30] to a workstation. So they're already uh [8:32] they might be on they're still within [8:34] the IT governance kind of regime but [8:36] they're not in the software development [8:38] part of the world right which is has its [8:40] a lot of things locked down. Um and as [8:43] soon as they end up on a workstation [8:45] then it often times loses visibility. I [8:47] I can't even count how many customers [8:48] we've talked to where they say well [8:50] what's this Python thing and what do you [8:52] mean it's installed on 10,000 laptops [8:53] across our business. Right? That's the [8:55] kind of that's of course to people in [8:56] this room that may sound hilarious but [8:58] it's it is hilarious to me as well but [9:00] it's a little bit tragic as well if [9:01] you're the business and you have all [9:02] these people relying on this really [9:03] incredible and powerful set of tools and [9:05] they the business doesn't even [9:06] understand that it's there right so um [9:09] this really becomes a problem when [9:11] people start going and installing new [9:13] pieces of software uh and and this is [9:16] something which probably all of you how [9:17] many people here actually you know do [9:19] some coding install stuff in public [9:21] repositories cran pipi cond right [9:24] exactly Right? For us, this is like [9:25] breathing. This is just of course this [9:26] is what you do. But if you think about [9:28] it from the way that again, enterprises [9:30] t tend to manage their software [9:31] procurement life cycle. This is [9:33] craziness. This is absolute craziness [9:35] that you can go and just randomly grab [9:36] stuff that could touch customer data, [9:38] PII, whatever. So they have, you know, [9:41] there's a wild west of software that [9:42] could bring they could bring in. There's [9:44] almost no visibility into what gets [9:46] installed uh onto a particular [9:48] workstation or onto a Linux, you know, [9:50] uh research workstation. Um and [9:52] furthermore, most of the people who are [9:54] doing this kind of work, now this is [9:55] specific, this slide is specific to data [9:58] scientists. But people who are AI vibe [10:00] coding, I assure you, don't have any [10:01] better understanding of software [10:02] security than the than the data [10:03] scientists, right? And so this is a [10:05] general problem that enterprises are [10:06] going to have to get used to because [10:07] they're going to say, well, um we're [10:09] going to have, you know, we're going to [10:10] make chatgbt or claude or or claude code [10:13] or something like this available for so [10:14] many people to do all this stuff. This [10:16] stuff starts spitting out Python code. [10:18] that Python code starts installing [10:19] random stuff and next thing you know you [10:21] have 10x number of software developers [10:23] inside the business than you had before [10:25] and they're going and spinning up all [10:26] sorts of random stuff and um obviously [10:30] as Anaconda we have a set of solutions [10:32] for helping people to manage some of [10:33] this complexity but even we cannot [10:36] necessarily get to securing everything [10:38] all the time right there's still stuff [10:40] that is out there and all we can do is [10:42] help uh businesses and customers at [10:44] least have start developing a strategy [10:46] that they can make sense sense for [10:48] themselves. Um, and so to give you a [10:50] picture, I I love illustrating people uh [10:52] to people just what all is involved. Uh, [10:54] how many people here have used a psych [10:55] scikitlearn or streamllet, tensorflow, [10:57] anything? So if you import one of these [11:00] things, if you actually look at how many [11:03] dependencies there are for just the most [11:05] basic, literally numpy, sci-fi, pandas [11:08] or numpy and pandas and scikitlearn, [11:10] whatever it might be, the number of [11:12] things that get pulled in to do the most [11:14] basic data or AI task is astronomical. [11:18] And you're doing this all the time. [11:20] You're constantly installing stuff. [11:21] You're creating new environments. You're [11:22] creating a new project. And the amount [11:24] of exposure that an organization has as [11:27] their users are doing this all the time [11:28] is vast and [11:31] yeah all sorts of problems there. So um [11:34] the approaches that we've seen [11:35] businesses take they you know sometimes [11:37] will do ma manual package management [11:39] they will vet specific packages they [11:41] might put in some you know some some [11:43] products in place to help them scan this [11:45] scan that scanning just to tells you [11:47] when you've kind of been uh when you [11:50] already have a problem I guess like the [11:51] problems already kind of happened. But [11:52] in any case, what we end up seeing here [11:54] is that there's not really um I I would [11:58] say there's not really an industry super [12:00] clear like the one way to do it. It [12:02] really does vary from business to [12:03] business, but as we talk to different [12:05] businesses, almost everyone knows that [12:07] they're only doing maybe 20 to 30% of [12:09] what they really need to do to get [12:10] really in good shape on this. And that's [12:12] kind of okay. again in a data science uh [12:14] sort of footing of like you know six [12:16] seven years ago now with AI coming just [12:19] down the track racing towards people all [12:21] of this stuff is about to get a lot more [12:23] real right so if you look at the kinds [12:24] of cyber attacks that are happening all [12:26] of the um black hat teams out in the [12:28] world including sovereign state actors [12:30] they understand that this is an [12:32] incredibly beautiful and powerful vector [12:34] to attack everyone on the planet so this [12:37] is we in the Python open source [12:39] community we see our our our community [12:42] infrastructure being stressed and [12:43] strained uh because of this kind of [12:45] thing happening. The number of LM [12:47] generated um uh the code repositories, [12:51] the number of LM generated projects that [12:53] are being uploaded, all of these kinds [12:55] of things, you know, they're not [12:56] intrinsically a problem, but when you [12:58] look at how many of them contain little [13:00] bits of weirdness here and there [13:01] specifically designed to uh get into [13:04] people's code bases, then it starts [13:06] really becoming a problem. So um [13:10] actually to the point where for instance [13:11] um this is JP Morgan uh this year they [13:14] just they issued a open letter to their [13:16] thirdparty software supplier saying you [13:18] must secure your stuff like this is not [13:21] acceptable anymore security is [13:23] absolutely not something we can [13:24] compromise on. So you see some of the [13:26] largest uh technology organizations in [13:28] the world taking this kind of stance [13:29] because they see exactly what's coming [13:30] down the pike. And just a little bit of [13:32] a plug here, Anaconda does have [13:33] solutions for some of these things. If [13:34] you're interested, if you don't feel [13:36] like you have your software supply chain [13:38] stuff in order, we're happy to talk to [13:40] you and suggest how we can plug in with [13:42] whatever you've got currently, maybe [13:44] explore some new solutions. But our goal [13:46] here is to ensure that people are able [13:48] to have a good time and have a [13:49] successful adoption of Python at the [13:51] enterprise scale. To make that happen, [13:53] you need to basically not be randomly [13:54] pulling in possibly, you know, hosed [13:56] pieces of open source, right? As a as a [13:58] bare minimum starting point. So we have [14:00] a lot of different tools and solutions [14:01] to help people work on this. We have [14:03] 10,000 customers who use various bits [14:05] and pieces of this kind of stuff. So [14:06] we'd love to chat with you if you're not [14:08] one of those 10,000 already. Um so then [14:11] once you let's say you get your supply [14:12] your software supply chain and your [14:13] software management stack in order, how [14:16] do you govern your data? Well, this is [14:18] absolutely a huge topic and it's a [14:20] really important topic because for all [14:22] of the discussions that people have [14:24] about, you know, state-of-the-art models [14:26] and like GPD5 was released and all the [14:28] stuff about the models and the models [14:29] and the models, what we all know is at [14:31] the end of the day, the models are [14:33] nothing without the data, right? The [14:34] models are really just reflections of [14:36] the data that was used to train them. [14:38] and um and and the quality of that data, [14:41] not just the not just the volume of it, [14:43] but the quality of it, the structure of [14:44] it, the precise way it was trained, uh [14:47] that the training process runs, all of [14:48] these things ultimately determine what [14:50] the embedding vectors look like. They [14:52] determine what the capability, the [14:53] reasoning capabilities of these models [14:55] look like. Um so we know these things [14:57] are fundamental and yet the current [14:59] state of things is a complete disaster, [15:01] right? the actual soft the actual data [15:04] sets that make their way into these [15:06] models from what we can tell back in the [15:09] day in the early days when the research [15:11] lab is still publishing uh we know it [15:13] was a disaster now they stopped [15:14] publishing because they know it's a [15:15] disaster and they don't want to get sued [15:17] anymore so we know that there's still a [15:19] lot of problems here um and this is not [15:22] just a problem for people making [15:22] state-of-the-art models for all of you [15:24] who are um you know probably end users [15:27] of those models people trying to build [15:28] enterprise solutions around AI um if [15:31] we're not paying attention to the data. [15:32] If we're not paying attention to how we [15:33] manage and govern the data providence [15:36] chain that goes into these models, um [15:38] then you end up with research results [15:39] like this causing you potentially a lot [15:41] of problems, right? For instance, this [15:43] this particular result um showed that [15:45] there is a certain kind of memorization [15:47] capacity within LLMs. Um I believe it's [15:51] 1.5 bit, no 3.6 bits per parameter. [15:55] And um what's interesting is the same [15:57] research group they demonstrated an [16:00] attack well I won't call it an attack [16:02] but they demonstrated a capability where [16:05] they can take a rag embedded database [16:07] that they know nothing about. So just a [16:09] bunch of embeddings and they can train a [16:10] similar they can train another database [16:12] which they do know the source data of [16:14] and they can compute a rotation or [16:16] transformation matrix that is then able [16:18] to retrieve specific pieces of PII and [16:21] other kinds of memorized data from the [16:23] first rag uh rag embedded database. Uh [16:27] that's a result that just came out in [16:29] the last I think three months or so. Um, [16:31] but imagine if you're a practitioner, if [16:33] you're an end user of these things, [16:34] you've been doing rag for a while and [16:35] you've got stuff sitting out there. You [16:37] know, that's that's an exposure that [16:39] just just happened to you and now you [16:40] got to scramble and figure out, oh my [16:42] god, what do I do about this? Right? So [16:43] the data management is such a huge part [16:46] of making these models work. And what I [16:49] see in practice is a lot of times people [16:51] treat the data set still as like they [16:54] don't they don't treat it the way that [16:55] enterprise data management has always [16:56] been done for databases, for data [16:58] warehouses. you know, those things are [17:00] somewhat cluji and old, but at the same [17:02] time, just throwing stuff into S3 [17:04] bucket, labeling it, sticking in a [17:06] readme, that is not sufficient to get [17:09] you to be able to respond to these kinds [17:10] of problems. Um, and I have much much [17:13] more to say about this topic, but we [17:14] don't have time to go into all that. So, [17:16] I would reference this particular uh QR [17:19] code uh with the cute Chrome dinosaur in [17:22] it because Chrome generated the QR code. [17:23] Um but this is a talk that I gave at [17:25] Harvard uh about ultimately how do we [17:28] think about even the s the underlying [17:30] data that went into things like GPT or [17:33] things like Gemini um the actual [17:35] underlying data that comes from a lot of [17:38] public and a lot of common sources. How [17:40] can we actually think about the legal [17:42] and the technical um underpinnings of [17:46] how all this stuff works? It kind of [17:47] gets into the philosophy of open source [17:49] and into uh my vision of what a future [17:53] truly open but not just open but [17:55] regenerative innovation commons looks [17:57] like in AI. So that topic is interesting [17:59] at all if you haven't fallen asleep yet [18:00] just from that sentence. If that's [18:01] interesting to you I would highly [18:02] recommend you take a look at this um and [18:04] and also um here in the fall I will be [18:07] putting out more information about this [18:09] particular project in conjunction with [18:10] many other groups in the world like [18:12] creative commons common crawl uh and a [18:14] bunch of other folks. So definitely look [18:17] uh keep keep an eye out for that. Okay. [18:19] And so the very last thing I'll talk [18:20] about is let's say you can manage your [18:22] data. Let's say you've got you know some [18:24] basic perspectives on how you're going [18:25] to manage this crazy open source wild [18:27] west that is going to be clearly the [18:28] software infrastructure for your AI [18:30] models. How do you actually manage the [18:31] models themselves? What does it look [18:33] like to deploy them? What does it look [18:34] like to to to have a center of [18:36] collaboration, a center of testing and [18:39] and monitoring, governance, all of that? [18:41] And so that then brings me to the topic [18:43] of having an actual AI platform, an [18:45] actual AI and model catalog system and a [18:48] well let's call it an infrastructure [18:50] where you can have all these things tied [18:52] together. So it's not just a bit of [18:53] GitHub over here, a Docker hub over [18:55] there, some scripts over there and and [18:57] somebody's you know Jupyter notebook [18:59] over running on server right. So right [19:01] now what from what I can see the [19:03] critical enterprise challenges that you [19:05] have even when you're using these open [19:06] weight models um is that the model [19:09] compliance is a huge problem. So, if you [19:11] actually go and spend some time maybe [19:13] tonight after all of the social events [19:14] and you have your whiskey, sit down and [19:17] really drill into some of the usage [19:19] licenses and rights on your favorite [19:21] model on HuggingFace and and you'll [19:24] start crying into your whiskey because [19:26] you're going to realize you're probably [19:27] not in compliance and you look at [19:29] something else and oh, that was [19:30] fine-tuned with this thing that has copy [19:31] fair on it. Turns out, well, I don't [19:33] know. Can you use copy fair things or [19:35] not? Right? There's all of these kinds [19:36] of open rail and all these different [19:38] kinds of licenses with all sorts of [19:39] different kinds of stipulations. And it [19:41] may seem like somewhat academic, but if [19:43] you're using these things in an [19:44] enterprise environment, a lawyer will be [19:46] asking you questions about does this [19:48] comply with our internal policies or [19:49] not. And you have to give them a best [19:51] effort answer and the answer might be [19:53] no. Right? So, we have to figure out how [19:54] to get around this. At least with open [19:56] source software, we've had things like [19:58] the um free software foundation and OSI [20:01] and whatnot. We've had many many many [20:02] decades of really big companies building [20:05] out on open source infrastructure. So [20:06] everyone feels like there's a safe [20:08] harbor of how we operate with open [20:09] source software. But with these models, [20:11] these openweight models, it's kind of a [20:13] wild west right now. And this is really [20:14] a dangerous area. You never want to be [20:16] wild west when it comes to legal stuff, [20:18] right? Um but additionally, even if you [20:21] could already clear through that and you [20:22] say, "No, Peter, I got it. That all [20:23] makes sense. thought I'm very very happy [20:25] with the state of our usage and [20:28] compliance of these model um uh model [20:31] terms and licenses. You then run smack [20:33] dab into the next problem which is how [20:34] do you actually secure those models? How [20:36] do you ensure that the one you got or [20:38] the one that this other user in this [20:40] other line of business is deploying [20:42] doesn't come from a fine-tune or [20:43] quantization or something that comes [20:45] from a malicious actor? Right? the way [20:47] that we that the kinds of attacks that [20:49] we're seeing on public software [20:51] repositories like Pippi, those pale in [20:54] comparison to the kinds of things that [20:55] are happening on public model [20:57] repositories like Hugging Face. There [20:58] are so many people, some of them are, [21:01] you know, doing bad code things. Some of [21:02] them are putting incredibly [21:03] inappropriate content uh into various [21:05] kinds of things that can get mixed in [21:07] and sloshed together with the models [21:08] that you want to deploy and put in front [21:10] of a chatbot that goes and talks to a [21:11] customer. Like these are these like this [21:13] is not really a good state of affairs [21:15] right now. So, uh, and I see we're a [21:18] little short on time. So, just passing [21:19] going through all of these things. At [21:21] the end of the day, what you're going to [21:22] end up having to do if you're doing this [21:23] stuff for real at all is you're going to [21:25] have to develop some kind of a [21:26] compliance and curation scheme within [21:29] your business and then have that center [21:31] of excellence or center of practice be [21:33] the one that is essentially the the [21:35] gatekeeper, the curator, the auditor for [21:38] all the rest of the business to actually [21:39] go and use. This is from my my [21:41] perspective. This is kind of how it has [21:42] to go. And so we have um we we've talked [21:46] to a bunch of customers. This is [21:47] something they all want. We are coming [21:49] out with a as part of our AI platform a [21:52] curation and a model governance center [21:54] where many different teams can get [21:57] together and they can actually govern [21:59] what what models they're getting, what [22:01] kinds of um uh what kinds of [22:03] collaboration dynamics they want to have [22:04] around it. You can actually apply [22:06] different kinds of compliance controls. [22:08] Um and you know if you want to deploy [22:10] those models right there you have your [22:11] own internal place where you can deploy [22:14] to on-rem deploy to hybrid cloud run [22:16] locally on a laptop. Um, especially for [22:18] people who are doing a lot of work with [22:20] drones or robots or any kind of sensor [22:22] platforms where you need to run these [22:24] very quantized, very lightweight models [22:26] in edge devices, there's a ton of [22:28] iteration that has to happen on that. [22:30] And that's generally harder to do when [22:32] you're using a lot of very cloud-centric [22:34] and big model ccentric infrastructure. [22:36] And we're designing and building this [22:38] from the ground up with an eye towards [22:39] supporting those kinds of edge use cases [22:41] and those kinds of fleet and field [22:43] deployments. So, if any of these things [22:45] are interesting to you, definitely [22:47] please again come by the booth and talk [22:48] to us. In particular, if you're [22:50] interested in having uh a really good [22:52] way of quantifying the performance and [22:53] the cost trade-offs for your big models [22:55] or your small models, those are the [22:57] kinds of things that we're um putting [22:59] into the interface and tweaking. We'd [23:00] love to get customer and prospect [23:02] feedback on that uh earlier ra than [23:04] later. Um and so, for instance, an [23:06] example of what what some of that [23:07] curation looks like in a UI for that uh [23:10] is right here. So you can verify the [23:11] licenses meet where your organizational [23:13] standards are. You can verify that you [23:15] know if you want to optimize something [23:16] for a particular platform. Let's say you [23:17] don't have H too many H100s you got to [23:20] go and run on something lower. You can [23:21] actually you can do that and ask for [23:23] optimizations quantizations. All these [23:24] kinds of things are things we're [23:25] building into the platform. Um and that [23:27] is uh that's something we'd love to talk [23:29] to you about if you're interested. And [23:30] again with this this is this is [23:32] connected to our software governance as [23:34] well. So you can ensure that when you [23:35] deploy these models the open source [23:36] software running in it is also you know [23:38] also meets all the various uh check [23:40] marks um uh and all the kind of [23:42] governance controls you may have on open [23:44] source software. So that's this is you [23:46] know our approach to governing at least [23:49] handling two of these really really big [23:50] important governance issues that face [23:52] people deploying um AI at enterprise [23:55] scale. And so the last thing I would say [23:57] here um before everyone heads off to [23:59] drinks um ultimately again just to [24:01] reiterate what I said before in order to [24:03] actually do a intellectually honest job [24:07] of governing and securing your [24:09] enterprise AI deployments you really [24:10] have to see it as a holistic problem and [24:13] the holistic problem is not un is not [24:14] intractable but it consists of pieces [24:16] that are themselves they are they are [24:18] hard they've been around for a long time [24:20] we've seen many people struggle with [24:21] each of these things um but to do AI [24:24] well you have to do all of these things [24:25] and you cannot have it really is not [24:27] helpful to engage in wishful thinking um [24:29] that oh this will just be taken care of [24:30] or oh everyone's just doing that surely [24:32] that's fine no everyone's doing that and [24:33] everyone is screwed right like it's not [24:35] fine and if you want to be fine you have [24:36] to actually be very intentional in your [24:37] thinking about this kind of thing so uh [24:40] if you want to talk about again just [24:41] even if it's not AI at all even if you [24:43] just want to talk to us about okay [24:44] finally management understands there's a [24:46] thing called Python we have a lot of it [24:48] and our AI future depends on it how in [24:50] the heck do we actually deploy and [24:51] govern Python at enterprise scale happy [24:54] to talk to you about all those things. I [24:55] was doing that for 5 years before I even [24:56] started the company, right? And that was [24:58] 12 years ago. So very very uh familiar [25:00] with engaging with customers on these [25:01] questions. But um hopefully that's um Am [25:05] I at time? Do I owe someone a drink [25:07] running over? I'm good. Okay, that's it. [25:08] All right, no time for questions. Thank [25:10] you everyone for listening. Please come [25:11] by the booth. We love to chat with you [25:12] more about any of these topics.