FHLB Topeka Uses Wall Street Model Framework to Police Generative AI

AI Risk Management: A Practical Blueprint from a Proven Framework on Wall Street With FHLBT — Ai4

Ai4

Post-crisis banking rules provide all necessary controls to govern generative and agentic AI without building new regulatory systems from scratch.

AI-assisted summary of AI Risk Management: A Practical Blueprint from a Proven Framework on Wall Street With FHLBT — original source. Check the original for full context.

Source published:

Detailed notes

## Background Published on YouTube by Ai4 on August 28, 2025, this presentation features Jenny Yu, Director of Model Risk Management and Methods at the Federal Home Loan Bank of Topeka. According to the page description, the talk provides a practical blueprint for managing modern AI risks across industries by adapting Wall Street's time-tested three-pillar model risk management framework—governance, owner's responsibility, and independent validation.

## TL;DR Jenny Yu demonstrates how the financial sector's two decades of black-box model risk management under SR 11-7 provide an actionable framework for governing modern AI systems. She breaks down AI into traditional, generative, and vendor categories, showing how targeted controls reduce inherent risk to acceptable residual levels across modular agentic architectures and LLM workflows. Using practical analogies—such as playground guardrails that enable free exploration and bathroom scales that establish reliable relative benchmarks—she details strategies for stress testing, vendor due diligence, and prompt-injection mitigation. Throughout the talk, Yu emphasizes that regardless of technological complexity, human-in-the-loop accountability, risk-tolerance tiering, and tone at the top remain essential to safe AI adoption.

## Atmosphere & style The presentation strikes a pragmatic, authoritative, and reassuring tone, opening with self-deprecating humor about standing between the audience and their lunch. Drawing on twenty years of hands-on financial engineering experience, Yu demystifies complex mathematical and regulatory concepts through relatable, visual metaphors like playground fences and bathroom scales. The delivery feels collaborative and empowering rather than restrictive, transitioning smoothly from high-level enterprise risk philosophy to granular technical oversight while instilling confidence in practitioners navigating modern AI governance.

## Key takeaways - [00:04](https://www.youtube.com/watch?v=fKXJhDljLTc&t=4s) Model risk management frameworks developed over decades in the financial sector serve as strategic business enablers, establishing guardrails that allow organizations to deploy innovative AI tools safely and confidently. - [03:13](https://www.youtube.com/watch?v=fKXJhDljLTc&t=193s) AI risk can be demystified and managed through the foundational equation Residual Risk = Inherent Risk - Controls, isolating specific failure modes to bring total exposure within corporate risk appetite. - [05:39](https://www.youtube.com/watch?v=fKXJhDljLTc&t=339s) AI systems require differentiated verification strategies across three operational categories: automated backtesting for traditional predictive AI, human-in-the-loop review for generative AI, and specialized due diligence for third-party vendor AI. - [07:10](https://www.youtube.com/watch?v=fKXJhDljLTc&t=430s) The SR 11-7 regulatory standard establishes a proven three-pillar governance structure: executive oversight with model inventory tiering, model owner accountability for testing and documentation, and structurally independent mathematical validation. - [07:10](https://www.youtube.com/watch?v=fKXJhDljLTc&t=430s) Model risk fundamentally stems from two primary failure points across the model lifecycle: incorrect algorithmic development or inappropriate business use. - [12:16](https://www.youtube.com/watch?v=fKXJhDljLTc&t=736s) Effective model governance requires decomposed backtesting against ground truth and setting clear quantitative risk tolerance thresholds to detect and manage performance drift. - [14:56](https://www.youtube.com/watch?v=fKXJhDljLTc&t=896s) Complex agentic AI architectures cannot be governed as opaque monoliths; risk teams must monitor, benchmark, and track performance across each individual autonomous agent independently. - [15:41](https://www.youtube.com/watch?v=fKXJhDljLTc&t=941s) Generative AI introduces novel threat vectors including hallucinations, internal data leakage, and malicious prompt injections that exploit conversational interfaces, requiring specialized protective interceptor tooling. - [17:14](https://www.youtube.com/watch?v=fKXJhDljLTc&t=1034s) Due diligence for external foundation models must focus on the business domain relevance of training data, sector-specific benchmark performance, and strict guarantees against vendor harvesting of proprietary queries. - [18:34](https://www.youtube.com/watch?v=fKXJhDljLTc&t=1114s) Through the bathroom scale analogy, consistent relative benchmarking across models provides reliable decision-making data for model selection and drift tracking even when absolute evaluation precision is impossible. - [20:31](https://www.youtube.com/watch?v=fKXJhDljLTc&t=1231s) Ultimate professional accountability cannot be delegated to automated systems; human ownership remains essential across all workflows, complemented by using modern AI tools to oversee and benchmark other AI systems.

## Detailed walkthrough ### [00:04](https://www.youtube.com/watch?v=fKXJhDljLTc&t=4s) Introduction and the Playground Analogy for AI Risk

Jenny Yu opens her presentation with a touch of humor, acknowledging that she is the only thing "standing between you and your lunch." Drawing on more than twenty years of experience in the financial industry developing and managing models, she introduces the core premise of her talk: the financial sector has spent over two decades developing robust frameworks to manage black-box risk. Rather than viewing risk management as an administrative bottleneck, she positions a practical, effective AI risk management framework as a "strategic enabler" designed to empower business leaders to adopt cutting-edge tools.

```mermaid flowchart LR accTitle: Playground Metaphor for AI Risk Management subgraph Playground["Playground Guardrails Metaphor"] A["Strong Guardrails / AI Risk Framework"] --> B["Safe Exploration & Free Movement"] B --> C["Confident Business Innovation"] end ```

To illustrate this philosophy, Yu presents an image of a playground. Children are able to run around "freely and happily" precisely because strong perimeter guardrails protect them from danger. In the exact same way, robust risk guardrails give business executives the confidence to deploy AI safely without fear of catastrophic fallout. She notes that while Wall Street began building black-box model management frameworks twenty years ago, these practices were not strictly enforced across the industry until the aftermath of the 2008 global financial crisis. Today, the mature lessons learned by large financial institutions provide an actionable blueprint for modern AI risk across all sectors.

[03:13](https://www.youtube.com/watch?v=fKXJhDljLTc&t=193s) The Core Risk Equation and Demystifying AI Risk

Reflecting on her career path from hands-on data scientist to model risk leader, Yu emphasizes her role in bridging the gap between mathematical algorithms, data pipelines, and overarching business strategies. She anchors AI risk assessment in the foundational risk equation:

$$\text{Residual Risk} = \text{Inherent Risk} - \text{Controls}$$

Inherent risk reflects the baseline complexity of the model, its operational footprint, and the potential consequence, magnitude, and likelihood of failure. By designing targeted controls and guardrails, organizations reduce that exposure down to a tolerable residual risk level that aligns with corporate risk appetite.

Yu demystifies the anxiety surrounding modern artificial intelligence. While many executives treat AI risk as an unprecedented, unmanageable monolith, she argues that breaking it down reveals familiar risk dimensions. Even with the rise of generative AI, the underlying operational and statistical failure modes are manageable using established governance principles once practitioners isolate the specific new mechanisms at play.

[05:39](https://www.youtube.com/watch?v=fKXJhDljLTc&t=339s) Categorizing AI: Traditional, Generative, and Vendor Systems

Because "not all AIs are created equal," risk management cannot take a one-size-fits-all approach. Yu segments artificial intelligence into three distinct operational buckets based on their architectural mechanics and verification pathways:

```mermaid flowchart TD accTitle: AI Categorization and Verification Approaches subgraph Categories["AI Categorization Architecture"] T["Traditional AI<br/>(ML, Statistical, Stochastic)"] G["Generative AI<br/>(LLMs, Content Gen)"] V["Vendor & Third-Party AI<br/>(Black-Box Solutions)"] end

subgraph Controls["Verification & Risk Controls"] T --> TC["Automated Backtesting &<br/>Benchmark Modeling"] G --> GC["Human-in-the-Loop &<br/>Direct Verification"] V --> VC["Targeted Due Diligence &<br/>Independent Replication"] end ```

- **Traditional AI (Machine Learning, Statistical, and Stochastic Models):** Typically applied to predictive tasks, complex forecasting, and pricing. Because human operators cannot manually verify complex statistical outputs at scale, they require automated backtesting and benchmark models to measure performance against ground truth. - **Generative AI:** Predominantly used to enhance human workflows and operational efficiency. Because these systems produce human-readable content or intermediate drafts, human reviewers can inspect and verify the outputs directly before execution. - **Vendor and Third-Party AI:** Packaged software and embedded vendor algorithms where internal weights or training data may be proprietary and opaque, requiring specialized third-party risk management and pointed questionnaire frameworks.

[07:10](https://www.youtube.com/watch?v=fKXJhDljLTc&t=430s) The Holistic Modeling Process and the Three-Pillar Framework (SR 11-7)

Yu outlines the lifecycle of a model as a holistic process that strictly begins with a "business purpose" and concludes with "business use." Across this pipeline, risk stems primarily from two root causes: incorrect development or inappropriate business use. Modelers must navigate data preprocessing, architectural tradeoffs between bias and variance, output calibration, and the explicit disclosure of operational limitations.

```mermaid flowchart TD accTitle: Three-Pillar Model Risk Management Framework subgraph Framework["SR 11-7 Three-Pillar Framework"] P1["Pillar 1: Governance & Oversight<br/>• Tone at the top & risk tolerance<br/>• Model inventory & tiering<br/>• Quarterly Board ERM reporting"] P2["Pillar 2: Model Owner Responsibilities<br/>• Development & implementation testing<br/>• Ongoing performance tracking<br/>• Comprehensive documentation"] P3["Pillar 3: Independent Validation<br/>• End-to-end conceptual soundness<br/>• Replication of vendor algorithms<br/>• Stress testing & limitation disclosure"] end P1 --> P2 P2 --> P3 ```

To govern this lifecycle, the financial sector relies on the supervisory guidance established under Federal Reserve SR 11-7 (and OCC Bulletin 2011-12), which Yu distills into three core pillars:

1. **Governance and Oversight:** Sets the "tone at the top," defining the organization's overarching risk tolerance and balancing operational gains against potential exposures. It establishes formal policies, roles, responsibilities, and maintains a centralized model inventory. Model tiering (categorizing models by complexity and business impact) dictates validation frequency and scrutiny. Model risk is integrated into Enterprise Risk Management (ERM) and reported quarterly to the Board of Directors. 2. **Model Owner's Responsibility:** The model owner—whether an internal developer or a business unit managing an external vendor—holds accountability for tracking model health. This includes implementation testing, establishing performance baselines, maintaining technical documentation for transparency, and intervening when performance drifts. 3. **Independent Validation:** A mathematically qualified team, structurally independent of model development and ownership, evaluates everything from input data integrity to algorithmic soundness. At Topeka and peer institutions, internal data scientists and computer science engineers independently replicate vendor models to uncover hidden sensitivities, stress-test underlying assumptions, and communicate boundary conditions clearly to senior leadership.

[12:16](https://www.youtube.com/watch?v=fKXJhDljLTc&t=736s) Practical Application: Interest Income Forecasting and Agentic AI

To make the framework concrete, Yu presents a banking use case: modeling net interest income. While the high-level math appears straightforward (for example, lending \$100 at a 6% interest rate yields \$6 in income), forecasting enterprise-wide interest income across volatile interest rate environments and shifting balance sheet volumes is mathematically complex.

```mermaid flowchart LR accTitle: Interest Income Model Validation and Agentic Decomposition subgraph Traditional["Traditional Validation Pipeline"] M["Income Forecast Model"] --> BT["Backtesting vs. Ground Truth"] BT --> EV["Component Evaluation:<br/>• Balance Sheet Volume<br/>• Interest Rate Trajectory"] end subgraph Agentic["Agentic AI Decomposition"] A1["Agent 1: Balance Sheet Analysis"] --> Calc["Consolidated Income Engine"] A2["Agent 2: Rate Discovery & Forecasting"] --> Calc end ```

The bank manages model risk in this scenario through systematic validation and monitoring: - **Inventory & Tiering:** The interest income model is cataloged in the institutional inventory and subjected to rigorous validation based on its critical financial impact. - **Decomposed Backtesting:** Validators compare model projections against historical actuals (ground truth), evaluating the aggregate income error alongside specific forecast drivers, isolating whether variance stemmed from interest rate fluctuations or balance sheet volume shifts. - **Tolerance-Linked Monitoring:** Model drift is governed by quantitative risk tolerance thresholds set by executive leadership. For instance, management may establish that a 5% overall income forecast error or a 1% interest rate deviation is within acceptable risk appetite given the operational utility of the model.

Yu extends this foundational paradigm into modern multi-agent systems. A complex calculation can be decomposed into specialized agentic AI modules—such as one autonomous agent evaluating balance sheet dynamics and a second agent retrieving and projecting market interest rates—demonstrating that multi-agent architectures can be governed and validated using the exact same modular risk principles.

[14:56](https://www.youtube.com/watch?v=fKXJhDljLTc&t=896s) Agentic AI Architecture and Granular Performance Monitoring

In complex financial workflows, critical outputs rely on intricate internal calculations rather than simple figures pulled off the public internet. Managing these pipelines requires breaking tasks down across multiple specialized components—for instance, using one agentic AI to handle rate calculations, alongside another agentic AI orchestrating subsequent processes with large language models. While framing this multi-agent setup is an intentional oversimplification to explain how modular frameworks interact with LLMs, it underlines a fundamental supervisory principle: balance and granular oversight.

When establishing performance monitoring for complex AI, practitioners cannot treat the pipeline as an undifferentiated monolith. It is not enough to evaluate the end-to-end outcome; teams must evaluate, benchmark, and continuously monitor the performance of each individual agentic component independently to detect where degradation, drift, or calculation errors enter the chain.

```mermaid flowchart TD accTitle: Modular Agentic AI Architecture and Monitoring subgraph MultiAgentPipeline["Multi-Agent Processing Pipeline"] A["Input / Raw Data"] --> B["Agentic AI 1: Rate Management"] B --> C["Agentic AI 2: Calculation & Processing"] C --> D["Large Language Model: Output Generation"] end subgraph GranularMonitoring["Granular Risk & Performance Oversight"] M1["Monitor Agent 1"] -.-> B M2["Monitor Agent 2"] -.-> C M3["Monitor LLM Output"] -.-> D end ```

[15:41](https://www.youtube.com/watch?v=fKXJhDljLTc&t=941s) The Generative AI Black Box: Hallucinations, Inaccuracy, and Prompt-Driven Breaches

Transitioning from traditional analytical models to generative AI means moving into "an even blacker box." When organizations utilize off-the-shelf foundation models without injecting proprietary enterprise data, internal control over the system's inner workings is minimal. Generative AI introduces distinct threat vectors that traditional model risk teams rarely had to confront at this scale: hallucinations, contextual inaccuracy, and novel avenues for data breaches.

Organizations do not need to invent every control from scratch, as established enterprise policies already mitigate standard risks. Traditional data governance and cybersecurity divisions exist specifically to safeguard information assets from conventional breaches. However, generative AI fundamentally alters the attack surface through interactive chat interfaces:

- **Malicious Prompt Injections:** Interactive prompt interfaces create opportunities for adversarial inputs designed to extract sensitive operational or proprietary data. - **Internal Data Leakage:** Implementing advanced architectures that feed internal institutional data into model workflows introduces fresh internal breach risks if boundaries are porous. - **Targeted Protective Tooling:** Once security teams clearly recognize that conversational interfaces represent an active vector for data breaches, they can deploy targeted guardrail tools to intercept and neutralize malicious prompts before they execute.

[17:14](https://www.youtube.com/watch?v=fKXJhDljLTc&t=1034s) Evaluating Third-Party Foundation Models and Vendor Data Integrity

When engaging external vendors for specialized LLM solutions, model risk managers must conduct rigorous technical due diligence rather than accepting generic performance claims. The foremost question enterprise buyers must ask involves the relevance of the underlying training data:

> "A very critical question you want to ask: what training data did they use, and how is it relevant to your business? For example, if they use the model to extract financial data from PDF files, it might not be good at drafting a lease for you."

Beyond business-task alignment, risk practitioners must demand granular performance transparency. While a vendor may advertise stellar aggregate benchmark scores across general benchmarks, model performance must be proven specifically within the enterprise's targeted operational sector. Furthermore, vendor data privacy controls require explicit verification: institutions must ascertain whether the vendor retains corporate interactions, whether client queries are harvested for continuous model training, and what safeguards exist to guarantee customer data remains compartmentalized and insulated against external exposure.

[18:34](https://www.youtube.com/watch?v=fKXJhDljLTc&t=1114s) Practical Tooling and the Bathroom Scale Analogy for Relative Accuracy

Evaluating generative models requires specialized risk tooling, but organizations must select solutions that match their specific operational exposure. Effective risk and validation tools should be lightweight, accessible, and easily integrated through APIs to provide automated, timely feedback. Crucially, as the AI domain rapidly transforms, validation tooling must evolve at a matching pace while remaining strictly non-invasive—evaluating performance externally through black-box testing without requiring intrusive access to the model's proprietary internal weights.

Addressing the challenge of benchmarking accuracy in generative systems, a pragmatic distinction exists between absolute precision and relative comparison:

> "If I try to find my weight, I can stand on a scale and get 130. That number cannot be used for medical purposes, because I don't know how accurate the scale is. But there's one thing I know: if you stand with me using the same scale and you weigh 150, you are heavier than me... and if my weight is 130 today and tomorrow is 150, it means I gained weight."

Even if an evaluation metric lacks perfect, ground-truth precision, establishing an identical, consistent measurement instrument across different vendor models provides dependable relative benchmarking. Model risk teams can confidently determine whether Model A outperforms Model B, or track whether a fine-tuned version is drifting over time, utilizing relative comparison to make informed selection and deployment decisions.

[20:31](https://www.youtube.com/watch?v=fKXJhDljLTc&t=1231s) Tone at the Top, Contextual Threat Modeling, and Human Accountability

A successful AI risk framework ultimately depends on executive leadership setting the right "tone at the top." Managing risk requires assessing both the magnitude and the realistic likelihood of potential harms against expected business returns. For instance, in specific regional banking contexts, raw public figures might theoretically be scraped, but adversary computing costs to mount an attack could far exceed the value of the target, rendering the realistic risk negligible.

Risk teams must view model oversight as an ongoing discipline blending art and science, informed by deep hands-on development experience. Regardless of technological advancements, foundational professional responsibility remains constant:

- **Accountability Transcends Tooling:** "As an individual, it doesn't matter if I use pen and paper, or I use Excel, or I use generative AI—if you provide the number, I hold the responsibility. I need to verify that." - **Human-in-the-Loop:** Automated outputs must never bypass direct personal ownership; human validation must anchor every operational handoff. - **AI to Oversee AI:** Rather than relying exclusively on manual testing, risk teams must actively harness modern AI tools to monitor, benchmark, and control underlying AI risks across the enterprise.

## Notable quotes > [00:04](https://www.youtube.com/watch?v=fKXJhDljLTc&t=4s) standing between you and your lunch — Jenny Yu

> [00:04](https://www.youtube.com/watch?v=fKXJhDljLTc&t=4s) strategic enabler — Jenny Yu

> [00:04](https://www.youtube.com/watch?v=fKXJhDljLTc&t=4s) freely and happily — Jenny Yu

> [05:39](https://www.youtube.com/watch?v=fKXJhDljLTc&t=339s) not all AIs are created equal — Jenny Yu

> [07:10](https://www.youtube.com/watch?v=fKXJhDljLTc&t=430s) business purpose — Jenny Yu

> [07:10](https://www.youtube.com/watch?v=fKXJhDljLTc&t=430s) business use — Jenny Yu

> [07:10](https://www.youtube.com/watch?v=fKXJhDljLTc&t=430s) tone at the top — Jenny Yu

> [15:41](https://www.youtube.com/watch?v=fKXJhDljLTc&t=941s) an even blacker box — Jenny Yu

> [17:14](https://www.youtube.com/watch?v=fKXJhDljLTc&t=1034s) A very critical question you want to ask: what training data did they use, and how is it relevant to your business? For example, if they use the model to extract financial data from PDF files, it might not be good at drafting a lease for you. — Jenny Yu

> [18:34](https://www.youtube.com/watch?v=fKXJhDljLTc&t=1114s) If I try to find my weight, I can stand on a scale and get 130. That number cannot be used for medical purposes, because I don't know how accurate the scale is. But there's one thing I know: if you stand with me using the same scale and you weigh 150, you are heavier than me... and if my weight is 130 today and tomorrow is 150, it means I gained weight. — Jenny Yu

> [20:31](https://www.youtube.com/watch?v=fKXJhDljLTc&t=1231s) As an individual, it doesn't matter if I use pen and paper, or I use Excel, or I use generative AI—if you provide the number, I hold the responsibility. I need to verify that. — Jenny Yu

## Mentioned Jenny Yu, Federal Home Loan Bank Topeka, Ai4, Wall Street, Federal Reserve SR 11-7, OCC Bulletin 2011-12, Enterprise Risk Management (ERM), Board of Directors, Microsoft Excel

## Video description Jenny Yu, Director, Model Risk Management and Methods, Federal Home Loan Bank Topeka

Abstracts

Not all AIs are created equal—and neither is AI risk management. This talk provides a practical blueprint for risk leaders and AI practitioners to build robust AI risk management programs by leveraging a trusted source: the proven framework of Wall Street.

Drawing on 20+ years of experience in model risk management within the highly regulated financial industry, Jenny will use the time-tested three-pillar framework—governance, owners' responsibility, and independent validation—to demonstrate how to adapt these principles to today's complex AI systems.

Attendees will leave with actionable strategies and a clear framework to help them embrace AI safely, confidently, and effectively, cutting through the complexity and hype to focus on the most impactful and measurable approaches to managing AI risk across all industries.

[Source](https://www.youtube.com/watch?v=fKXJhDljLTc)

中文简报

FHLB Topeka借助华尔街模型框架管控生成式AI 危机后的银行业规则提供了治理生成式与代理式AI所需的全部控制措施，无需从零构建全新的监管体系。 Jenny Yu展示了金融行业在SR 11-7指引下积累的二十年黑盒模型风险管理经验，如何为治理现代AI系统提供切实可行的框架。她将AI细分为传统型、生成式和供应商采购三类，阐明了针对性控制措施如何在模块化代理架构与LLM工作流中将固有风险降至可接受的残留水平。结合保障自由探索的游乐场护栏、建立可靠相对基准的体重秤等生动比喻，她详细介绍了压力测试、供应商尽职调查以及防范提示词注入的策略。Yu在演讲中强调，无论技术多么复杂，“人在回路”的问责制、风险承受度分级以及高层的重视与定调，对于安全应用AI而言依然不可或缺。 Jenny Yu 将华尔街二十余年的模型风险管理（MRM）经验转化为 AI 治理蓝图，指出风控护栏是推动业务创新的战略赋能工具，并通过“残余风险 = 固有风险 - 控制措施”的基础公式化解对黑盒 AI 的焦虑。 (0:04) 针对传统预测型 AI、生成式 AI 及第三方模型，机构应依据美联储 SR 11-7 监管标准建立三大支柱：高管层治理与清单分级、模型所有者全周期监控责任，以及由专业团队开展的结构独立验证。 (7:10) 针对复杂的多智能体（Agentic AI）架构，风险团队不能将其视为未分化的黑盒单体，而必须对各个独立的自主 Agent 模块分别进行性能监控、基准测试与偏差回测。 (14:56) 生成式 AI 引发了提示词注入与数据泄露等新型攻击界面；对此，企业可通过一致的“相对精度”尺度横向比选模型并跟踪漂移，同时必须坚持人类在环（Human-in-the-loop）的终极业务追责机制。 (18:34)

Reading summary

Drawing on over two decades of financial sector model governance, Jenny Yu of FHLBT argues that robust risk guardrails serve as strategic enablers for AI adoption rather than bureaucratic bottlenecks. The mature supervisory frameworks developed after the 2008 financial crisis provide an actionable blueprint for managing modern traditional, generative, and agentic AI systems. The Three-Pillar Governance Blueprint (7:10) Yu anchors AI governance in the foundational risk equation where residual risk equals inherent risk minus controls. Rather than treating AI as an unprecedented challenge, she points to the Federal Reserve SR 11-7 and OCC Bulletin 2011-12 frameworks, which govern model lifecycles from initial business purpose to final deployment. This framework rests on three pillars: executive governance that sets risk appetite and maintains a tiered model inventory; model owner accountability for testing, baseline documentation, and drift remediation; and structurally independent validation by technically qualified teams who replicate algorithms and test boundary conditions. Segmenting Risk Controls Across AI Architectures (5:39) Because operational mechanics differ, Yu segments AI into three distinct categories with tailored controls. Traditional machine learning and stochastic models forecast numerical outcomes at scales beyond manual human review, necessitating automated backtesting and benchmark models against ground truth. Generative AI primarily assists human workflows with text and content, allowing human-in-the-loop reviewers to inspect drafts directly prior to execution. Third-party vendor systems present black-box risks with proprietary weights, requiring structured due diligence, targeted security questionnaires, and independent replication by internal technical teams. Modular Oversight for Agentic and Complex Systems (12:16) To demonstrate model risk principles in practice, Yu reviews a net interest income forecasting use case, where balance sheet volumes and interest rate movements are backtested against actuals to isolate specific drivers of error within tolerance thresholds, such as a 5% forecast variance or a 1% rate deviation. She extends this logic to modern multi-agent architectures, where specialized autonomous agents perform discrete sub-tasks like rate discovery and calculation before piping data to large language models. Yu emphasizes that oversight must not treat pipelines as single black boxes; teams must benchmark and monitor each agentic component independently to pinpoint where calculation errors or drift occur. Mitigating Generative AI and Third-Party Risks (15:41) Generative AI introduces failure modes such as hallucinations, contextual inaccuracies, and chat-interface data breaches via prompt injections or porous enterprise boundaries. When vetting external foundation models, Yu advises organizations to scrutinize training data relevance, demand task-specific rather than generic benchmark results, and confirm whether vendor platforms retain customer queries to train future iterations. To evaluate accuracy externally without accessing proprietary weights, she uses a bathroom scale analogy: even if an evaluation metric lacks absolute medical-grade precision, consistent relative benchmarking reliably reveals whether one model outperforms another or whether fine-tuned models are degrading over time. Yu concludes that effective AI governance blends technical science with practical judgment, noting that threat evaluations must balance the severity of failure against the realistic likelihood and cost of an attack. Crucially, technological sophistication does not disperse accountability: human operators maintain personal responsibility for validating outputs regardless of whether a calculation originates from a spreadsheet or generative AI, and risk teams should actively deploy AI tools to supervise enterprise models.

精炼阅读摘要

资深金融模型风险专家Jenny Yu指出，现代人工智能带来的黑箱挑战并非完全不可控，华尔街在2008年金融危机后建立的成熟模型风险管理经验，能够为企业安全采用AI提供实用的治理蓝图。 护栏机制与核心风险公式 (0:04) Yu将风险管理比作操场的防护栏：只有设立了坚固的边界，业务部门才能自由、自信地进行创新，而不必担忧灾难性后果。从底层逻辑来看，AI风险评估依托于基础公式“残余风险 = 固有风险 - 控制措施”。固有风险由模型的内在复杂度、业务应用规模以及潜在故障的严重程度与发生概率共同决定；组织需要通过针对性的管控将风险压缩至企业风险胃纳允许的残余水平。尽管生成式AI带来了新型交互模式，但其底层的统计与运营失效模式依然可以通过既有的治理框架进行分解和掌控。 基于架构特征的三类AI管控路径 (5:39) 由于各类AI的技术机制不同，治理策略不能一刀切。Yu将AI划分为三类：第一类是传统机器学习与统计模型，多用于复杂的预测和定价，由于人工无法直接规模化校验海量数值，必须依靠自动化回测和基准模型对比真实值来衡量表现；第二类是生成式AI，多用于提效与内容草拟，其产出可直接由人类进行审阅与核实；第三类是第三方供应商AI，通常属于内部权重和训练数据不公开的黑箱，需要依靠严格的尽职调查问卷及独立的外部复现测试来进行验证。 SR 11-7模型风险三支柱体系 (7:10) 银行业普遍依据美联储SR 11-7及OCC 2011-12指引管理模型全生命周期。该框架包含三大支柱：其一是顶层治理与监督，确立全行风险偏好，建立集中式模型清单与分级制度，并将模型风险纳入企业全面风险管理（ERM）向董事会进行季度汇报；其二是模型所有者职责，内部开发者或业务线需负责实现测试、基线监控、维护技术文档并在性能漂移时介入；其三是独立验证，由组织上独立的专业团队全面审查底层假设、复现供应商算法，并向管理层明示使用边界与压力测试结果。以银行净利息收入预测为例，团队通过将综合误差拆解为利率波动与资产负债表规模两个维度，并设定可容忍的偏差阈值（如总体收入预测误差5%或利率偏差1%），实现了精细化监控。 多智能体拆解与生成式AI威胁 (14:56) 对于复杂的多智能体架构，企业应采用模块化方式拆解监控，分别对负责利率运算、业务调度和语言生成的各个智能体实施独立基准测试，避免将复合管线视为单一黑箱。当迈入生成式AI领域时，黑箱程度进一步加深，伴随出现幻觉、事实偏差和以提示词注入为代表的新型攻击面。由于对话界面直接暴露在外，恶意输入可能诱发内部机密数据泄漏。安全团队必须建立前置拦截护栏，同时企业在引入第三方大模型时，必须核实训练数据与自身业务的匹配度，并严格审查交互记录是否会被供应商挪用于二次训练。 相对精度评估与人的最终责任 (18:34) 在缺乏绝对标准答案的生成式AI评估中，Yu提出了“体重秤类比”：即家用体重秤测出的具体读数未必符合医疗精度，但只要使用同一台秤，就能可靠地比对出两人谁更重，或判断自身体重是否随时间增加。因此，建立一套一致且非侵入式的相对评测工具，足以支持跨模型选型及漂移监测。最后，Yu强调无论工具从纸笔、Excel演进到生成式AI，输出结果的业务责任始终在人，自动化绝不能绕过人工监督；同时，防御团队也应主动利用现代AI工具来监控和制约企业内的底层AI风险。 该框架表明成熟的金融风控方法可有效迁移至AI治理，但其落地依赖于企业高管对潜在危害与商业回报的理性权衡，以及在高度动态的技术演进中保持持续的独立验证与人工把关。

Detailed notes — zh

## Background 该内容由 Ai4 于 2025 年 8 月 28 日发布在 YouTube 平台。视频记录了托皮卡联邦住房贷款银行（FHLBank Topeka）模型风险管理与方法总监 Jenny Yu 的专题演讲，重点分享如何依托华尔街二十余年经过金融危机检验的“治理体系、所有者责任与独立验证”三大支柱框架，为当今各行业构建兼具实操性与安全性的 AI 风险管理蓝图。 ## TL;DR 演讲强调 AI 风险管理并非阻碍创新的繁文缛节，而是像游乐场护栏一样的战略赋能器，其核心目标是通过针对性控制措施将残余风险压减至业务容忍度之内。基于华尔街 SR 11-7 监管指引，Jenny 详细拆解了涵盖治理体系、所有者责任与独立验证的三大支柱，并展示了如何将该框架延伸至传统预测模型、生成式 AI 以及前沿的多智能体（Agentic AI）协同架构。通过银行净利息收入预测实战和“体重秤相对比较法则”，她提供了穿透审查第三方模型、分层监控智能体性能以及选型风险评估工具的具体路径。演讲最后总结道，企业必须坚持高层定调、恪守人在回路（Human-in-the-loop）的终极责任，并学会以 AI 工具治理 AI 风险。 ## Atmosphere & style 演讲整体氛围严谨专业又极富亲和力，讲者开场以幽默自嘲化解午餐前的时间压力，迅速抓住现场注意力。在阐述严苛的金融风控与复杂算法治理时，她善于运用“游乐场护栏”和“体重秤比喻”等生活化案例，将晦涩的数学公式与监管条款转化为直观、落地的工程常识。整场分享展现出华尔街资深风控专家特有的冷静与透彻，在当下的 AI 狂热与恐慌叙事中，为从业者提供了一种极具掌控感与确定性的理性视角。 ## Key takeaways - [00:04](https://www.youtube.com/watch?v=fKXJhDljLTc&t=4s) AI 风险管理并非阻碍创新的繁文缛节，而是如同游乐场四周的安全护栏（Guardrails），是让业务领导者能够放心、规模化应用 AI 的关键战略赋能器。 - [03:13](https://www.youtube.com/watch?v=fKXJhDljLTc&t=193s) 风险管理遵循核心方程“残余风险 = 固有风险 - 控制措施”，企业的治理目标并非消除所有风险，而是通过搭建针对性控制护栏将残余风险压缩在业务容忍度之内。 - [03:13](https://www.youtube.com/watch?v=fKXJhDljLTc&t=193s) 评估 AI 风险须深入穿透潜在后果、影响量级和发生概率三要素；生成式 AI 带来的威胁并非完全未知，绝大多数风险维度在华尔街传统模型治理中早有先例可循。 - [05:39](https://www.youtube.com/watch?v=fKXJhDljLTc&t=339s) “并非所有 AI 生而平等”，企业应将 AI 划分为传统统计/机器学习模型、生成式 AI 与第三方供应商 AI 三类，并根据其黑盒深度和交互特性采取差异化治理策略。 - [05:39](https://www.youtube.com/watch?v=fKXJhDljLTc&t=339s) 模型全生命周期始终面临“错误开发”与“不当使用”两大核心风险，团队在开发中需透明权衡偏差与方差，并向业务端明确披露模型的能力边界与局限性。 - [08:28](https://www.youtube.com/watch?v=fKXJhDljLTc&t=508s) 源自 SR 11-7 指引的第一支柱为治理体系（Governance），核心在于“高层定调”，确立全行统一的模型清单与风险分级分类机制，并按季度向董事会汇报风险敞口。 - [08:28](https://www.youtube.com/watch?v=fKXJhDljLTc&t=508s) 第二支柱与第三支柱分别强调模型所有者责任与独立验证：所有者负责日常跟踪与技术留痕，而独立验证团队必须与业务脱耦，具备自主复现代码和测试极端假设的能力。 - [12:16](https://www.youtube.com/watch?v=fKXJhDljLTc&t=736s) 模型性能监控必须与高管设定的量化容忍度挂钩（如预测偏离百分比阈值），通过权衡应用 AI 获得的商业回报与潜在失误代价来设立风控红线。 - [14:56](https://www.youtube.com/watch?v=fKXJhDljLTc&t=896s) 在多智能体（Agentic AI）协作系统中，风控监测绝不能仅停留在端到端总输出，必须穿透到每一个协同的子 Agent 并对其独立性能与行为实施精细化监控。 - [15:41](https://www.youtube.com/watch?v=fKXJhDljLTc&t=941s) 生成式 AI 构成了更深层次的黑盒，引入了幻觉及恶意提示词泄密等新型风险，采购外部模型时必须严格审查训练数据相关性、垂直领域基准以及数据隐私回流机制。 - [18:34](https://www.youtube.com/watch?v=fKXJhDljLTc&t=1114s) 风控工具选型应遵循易用自动化、持续演进和非侵入原则；在绝对精度难以衡量的场景下，借助“体重秤法则”进行统一基准下的相对比较足以支持高效决策。 - [20:31](https://www.youtube.com/watch?v=fKXJhDljLTc&t=1231s) 无论技术如何演变，决策与结果的终极责任始终在人（Human-in-the-loop），同时企业应结合自身真实敞口避免过度防护，并积极学会“以 AI 治理 AI”。 ## Detailed walkthrough ### [00:04](https://www.youtube.com/watch?v=fKXJhDljLTc&t=4s) 华尔街二十年黑盒风险管理经验：安全护栏赋能 AI 业务创新 演讲开场时，主讲人 Jenny Yu 带着轻松幽默的语气调侃道，她深知自己正站在“大家与午餐之间”，非常感谢现场观众的驻留。作为在金融行业深耕超过二十年的资深从业者，她指出金融界早在二十年前就已经开始构建用于管理“黑盒”（Black-box）算法风险的框架。一个切实有效且落地的 AI 风险管理框架，其本质绝非阻碍创新的繁文缛节，而是一个关键的“战略赋能器”（Strategic Enabler）。 为了生动阐述风险管理与业务创新的关系，Jenny 展示了一幅儿童游乐场的画面：孩子们之所以能够在滑梯与草地上无拘无束、欢快地自由奔跑，核心前提是游乐场四周安装了坚固的安全护栏（Guardrails）。AI 风险管理在企业中扮演的正是这种护栏角色——它通过划定清晰的安全边界，让业务领导者能够满怀信心地安全使用 AI。Jenny 回顾道，尽管华尔街早在数十年前就探索模型管理，但直到 2008 年全球金融危机爆发后，监管层与大型金融机构才真正强制并系统化地推行这一体系。历经多轮金融周期考验的成熟框架，为当今各行各业应对复杂的 AI 风险提供了极具实操价值的现成蓝本。 ```mermaid flowchart TD accTitle: 金融级风险管理赋能逻辑 subgraph S1["安全底座构建"] A["20年华尔街黑盒治理经验<br/>(金融危机实战检验)"] --> B["建立清晰安全护栏<br/>(Guardrails)"] end subgraph S2["业务价值释放"] B --> C["有效控制残余风险"] C --> D["赋能业务领导者<br/>自信且安全地规模化应用 AI"] end ``` --- ### [03:13](https://www.youtube.com/watch?v=fKXJhDljLTc&t=193s) 风险核心方程与生成式 AI 风险的本质剖析 从一线数据科学家起步，到全面负责模型开发、模型治理及机器学习风险管理，Jenny 在过去二十年中见证了算法在投资策略、风险控制和运营提效等各个维度的应用。这种跨界经历使她能够打破技术与商业之间的壁垒，架起“数据算法、业务流程与商业战略之间的桥梁”。在剖析风险时，她提出了风险管理的基础核心方程： $$\text{残余风险 (Residual Risk)} = \text{固有风险 (Inherent Risk)} - \text{控制措施 (Controls / Guardrails)}$$ 所谓固有风险，取决于模型本身的算法复杂度以及该业务场景失败时带来的潜在破坏力；而控制措施则是围绕模型搭建的各类防御护栏。企业无法完全消除风险，其核心目标是通过针对性的控制手段，将残余风险压缩至管理层可接受的容忍度（Tolerance）区间之内。Jenny 强调，评估 AI 风险必须穿透到三个核心要素：潜在后果（Consequences）、影响量级（Magnitude）以及发生概率（Likelihood）。当下许多人对 AI 风险产生恐慌，认为生成式 AI（Generative AI）带来了无法驾驭的全新威胁；但如果从风险机理深层拆解就会发现，绝大多数风险维度在传统金融模型中早有应对先例，关键在于厘清生成式 AI 究竟引入了哪些增量变量，并匹配相应的控制工具。 - **固有风险（Inherent Risk）**：由算法本身的黑盒属性、数据依赖度及业务影响权重决定。 - **控制护栏（Controls / Guardrails）**：根据具体风险类型定制的校验、测试与防御机制。 - **残余风险（Residual Risk）**：实施控制措施后剩余的风险暴露，需通过企业战略容忍度进行对冲与管理。 - **核心评估维度**：风险触发后果、影响量级与发生几率。 --- ### [05:39](https://www.youtube.com/watch?v=fKXJhDljLTc&t=339s) AI 的三类分类法与全生命周期建模过程 “并非所有 AI 生而平等”（Not all AIs are created equal）。Jenny 强调，不同技术类别与使用场景所引发的风险截然不同，治理手段也必须因地制宜。她将企业中应用的 AI 划分为三大类别： 1. **传统 AI 与统计/随机模型（Traditional AI）**：涵盖预测型机器学习、时间序列预测及各类随机数模拟工具。这类模型具备极强的黑盒特性，人类专家通常无法仅凭直觉进行人工逐项验证，必须依赖回溯测试（Back-testing）和基准测试（Benchmark testing）等辅助量化手段进行校验。 2. **生成式 AI（Generative AI）**：目前多用于增强人类工作流。在许多场景下，人类专家嵌入在业务链路中（Human-in-the-loop），可以直接对模型生成的文本、代码或逻辑输出进行直观核验。 3. **供应商第三方 AI（Vendor AI）**：企业采购的外部系统或集成工具，其底层算法通常对外保密。管理重点在于供应链准入审查，必须提出正确的针对性问题，穿透审查其 AI 逻辑的合规性与稳定性。 ```mermaid flowchart LR accTitle: 模型全生命周期风险管理 subgraph P1["定义与准备"] A["业务目标明确<br/>(Business Objective)"] --> B["数据采集与预处理<br/>(Data Pre-processing)"] end subgraph P2["建模与权衡"] B --> C["模型构建与算法选择<br/>(偏差-方差权衡)"] end subgraph P3["落地与监控"] C --> D["输出监控与风险披露<br/>(Limitations Disclosure)"] --> E["最终业务应用<br/>(Business Use)"] end ``` 无论模型多么复杂，其全生命周期始终始于明确的“业务目标”，终于最终的“业务应用”。伴随模型全周期的两大核心风险在于：**错误开发（Incorrect Development）** 与 **不当使用（Inappropriate Use）**。在建模过程中，团队必须在偏差（Bias）、方差（Variance）与性能之间做出透明的工程权衡，持续监控模型输出，并向业务端清晰披露工具的“能力边界与局限性”（Limitations）——既要发挥其强大威力，更要明确其“能做什么，绝不能做什么”。 --- ### [08:28](https://www.youtube.com/watch?v=fKXJhDljLTc&t=508s) SR 11-7 监管指引下的三大支柱框架：治理、所有者责任与独立验证 美国金融监管机构发布的 SR 11-7（模型风险管理监管指引）是华尔街风控的黄金标准。Jenny 团队依托该指引，提炼出可无缝迁移至 AI 治理的“三大支柱框架”： ```mermaid flowchart TD accTitle: SR 11-7 模型风险管理三大支柱 subgraph P1["第一支柱：治理体系 (Governance)"] G1["高层定调 (Tone at the Top)<br/>权衡风险与收益"] G2["模型清单与分级分类<br/>(Inventory & Risk Tiering)"] G3["董事会季度风险报告<br/>(ERM 整合汇报)"] end subgraph P2["第二支柱：模型所有者责任 (Model Owner)"] O1["全周期性能跟踪与测试"] O2["重大漂移响应机制"] O3["逻辑透明度与文档留痕"] end subgraph P3["第三支柱：独立验证 (Independent Validation)"] V1["全要素端到端穿透审查"] V2["自主代码复现与基准测试"] V3["假设压力测试与局限性披露"] end ``` #### 第一支柱：治理体系（Governance） 治理确立了企业内部的政策、流程、角色分工与职责界定。Jenny 特别强调“高层定调”（Tone at the Top）的关键意义：银行或企业的董事会及高管层必须明确自身的风险容忍度，在效率收益与潜在风险之间寻求动态平衡。在此基础上，建立全行统一的模型资产清单（Model Inventory），依据模型复杂度和业务影响量级进行分级分类管理，并纳入企业全面风险管理（ERM）体系，按季度直接向董事会汇报。 #### 第二支柱：模型所有者责任（Model Owner's Responsibility） 模型所有者涵盖了内部研发团队以及采购外部算法的业务部门负责人。所有者必须承担端到端责任：在开发与实施阶段进行严格的性能测试，建立日常跟踪机制以应对数据漂移或重大性能滑坡，并产出详尽透明的技术文档，确保算法逻辑具备可解释性与审计留痕能力。 #### 第三支柱：独立验证（Independent Validation） 监管规定验证团队必须独立于模型开发和使用方，审查范围覆盖数据输入、算法逻辑、参数假设到输出结果的全流程。在 Topeka 联邦住房贷款银行（FHLBank Topeka）及同等规模的金融机构中，虽然大量信贷与风险管理依赖成熟的外部供应商模型，但其内部的数据科学家和计算工程团队具备自主复现（Replicate）供应商模型的能力。通过独立重构模型并测试极端假设，团队能够精准识别“当核心假设发生变动时，输出结果将产生何等剧烈的震荡”，并将这些隐藏风险与边界条件清晰传递给高级管理层。 --- ### [12:16](https://www.youtube.com/watch?v=fKXJhDljLTc&t=736s) 净利息收入预测实战案例与 Agentic AI 落地推演 为了将抽象的框架落地，Jenny 分享了一个经典的银行净利息收入（Net Interest Income, NII）预测案例。从最直观的算术逻辑来看： $$\text{利息收入} = \text{放贷本金 (\$100)} \times \text{执行利率 (6\%)} = \$6$$ 然而在真实银行运营中，宏观利率走势预测与全行资产负债表（Balance Sheet）的动态推演极其繁复，必须依赖多重模型联合运算。在风控落地中，该模型被登记入库并接受严格的独立验证。验证团队依托历史实际数据作为“真实基准”（Ground Truth）开展回溯测试，不仅对比最终收入预测的绝对偏差，更深入拆解利率预测误差与资产负债规模误差各自的贡献度，精准定位模型漂移的源头。 更为关键的是，模型性能监控与业务高管设定的“风险容忍度”紧密绑定。例如管理层明确划定： - 若全行总收入预测误差在 **5%** 以内，属于模型正常统计波动，在业务容忍范围之内； - 若基准利率预测的偏离度控制在 **1%** 阈值之内，则视为合格。 这种容忍度标准由业务端高管根据“应用该模型所获取的商业收益”与“潜在预测失误代价”权衡确立。在演讲的最后，Jenny 将这一经典金融测算场景延伸至前沿的 **智能体 AI（Agentic AI）** 架构：若将该复杂任务解耦为多个协同运作的 AI Agent——由一个智能体负责解析资产负债表并测算收入，另一个生成式智能体负责检索并对齐全网动态利率——传统金融沉淀的这套分级验证与容忍度监控逻辑，依然是约束智能体协同系统最有效的底层护栏。 ### [14:56](https://www.youtube.com/watch?v=fKXJhDljLTc&t=896s) 智能体协作与大语言模型监控 在涉及非常复杂的计算时，系统所需的数据往往无法直接从互联网获取。此时可以通过多智能体（Agentic AI）协同工作来解决问题：例如引入专门的智能体来协助管理利率，再由第三个智能体负责执行后续逻辑。虽然这是一种高度简化的解释方式，但它直观地展示了传统风险管理框架如何适配由大语言模型（LLM）驱动的复杂智能体系统。在多智能体架构下，监控的核心在于“平衡与拆解”——绝不能仅仅停留在对系统整体输出的粗放监控上，而是必须穿透并深入到每一个单独的 Agentic AI 中，对其运行性能与行为表现进行独立、细致的监测。 ```mermaid flowchart TD accTitle: 复杂多智能体协同与分层监控架构 subgraph MultiAgentSystem ["多智能体业务系统"] A["复杂数据输入"] --> B["利率管理智能体"] B --> C["业务执行/处理智能体"] C --> D["最终决策/输出"] end subgraph MonitoringLayer ["性能与风险监控层"] M1["单体 Agent 性能监控"] -.-> B M2["交互及执行监控"] -.-> C M3["端到端综合评估"] -.-> D end ``` --- ### [15:41](https://www.youtube.com/watch?v=fKXJhDljLTc&t=941s) 生成式 AI 的新风险与供应商模型审查 谈及生成式 AI（Generative AI），它在实际应用中往往是一个“更深的黑盒”（an even blacker box）。如果直接调用外部大语言模型而没有输入企业自有的专有数据，使用者几乎无法对其内部机制实施有效控制。生成式 AI 所带来的全新风险主要集中在幻觉（Hallucination）、结果不准确（Inaccuracy）以及数据泄露（Data Breach）。 针对数据泄露这类安全问题，银行或大型组织内部通常已具备成熟的数据风险治理与网络安全（Cybersecurity）规程。然而，大语言模型交互界面（如 Chatbox）引入了特有的新型风险——例如通过“恶意提示词”（Malicious Prompt）诱发的数据外泄。组织必须清醒地识别这种新型风险点，并部署针对性的工具进行拦截与防范。若进一步引入企业内部私有数据进行训练或增强，数据泄露的暴露面还会相应增加。 在引入第三方供应商的大语言模型时，企业必须严格提出以下关键审查问题： - **训练数据相关性**：供应商使用了哪些训练数据？这些数据与企业的具体业务场景有多大相关度？例如，若模型原本只用于从 PDF 文件中抽取财务数据，它很可能根本无法胜任租赁合同（Lease）的起草工作。 - **垂直领域性能表现**：模型除了提供一个通用的综合性能评分之外，在企业所处的特定垂直业务领域是否具备经得起检验的基准表现？ - **数据回流与隐私安全**：供应商是否会收集用户提交的数据？是否会将企业数据投入到后续的模型训练中？如果声称不会，他们采取了哪些切实的技术与合规手段来防止数据泄露？ --- ### [18:34](https://www.youtube.com/watch?v=fKXJhDljLTc&t=1114s) 风险评估工具的选择原则与“体重秤”相对比较法则 在选择用于生成式 AI 的风险管理工具时，由于每个企业的风险敞口高度个性化，工具的选型必须遵循几条核心工程原则： 1. **易用性与自动化**：工具应当足够便捷，只要提供 API 访问权限即可自动开展测试并提供及时反馈。 2. **动态进化能力**：AI 技术迭代极其迅猛，管理工具必须具备持续演进的能力以跟上威胁的变化。 3. **非侵入性（Non-invasive）**：工具无需强行访问模型底层复杂的内部机制，完全能够从外部发起测试和黑盒评估。 对于模型选型中的精度与评估问题，Jenny 提出了一个极为形象的“体重秤比喻”： > “如果我站上体重秤称出 130 磅，这个数字可能无法直接用于严苛的医疗诊断，因为我并不知道这台秤的绝对精度究竟如何。但有一件事我是确定的：如果你和我站上同一台秤称出 150 磅，那你一定比我重；如果我今天称是 130 磅，明天称变成了 150 磅，那说明我确实变胖了。” 这种**相对比较（Relativity in comparison）**在模型选型中极具实用价值。在现实业务中，追求绝对精确往往成本极高甚至不切实际，但在统一评估基准下使用同一工具对不同模型进行相对优劣比对，足以支撑高效、可靠的模型决策。 --- ### [20:31](https://www.youtube.com/watch?v=fKXJhDljLTc&t=1231s) 核心总结：基调、人在回路与以 AI 管控风险 在演讲的结尾部分，Jenny 总结了建立 AI 风险管理体系的几项核心行动指南： - **高层定调（Tone from the top）**：组织高层必须自上而下明确合规与创新的基调，深刻理解 AI 所引发的风险本质、潜在危害量级以及发生概率，始终在风险与收益之间寻求动态平衡。 - **结合业务实际评估风险敞口**：以数据泄露风险为例，部分银行内部场景的数据价值有限，外部攻击者甚至不值得耗费高昂的算力成本来破解此类数字，因此该特定维度的实际风险敞口极低，无需过度防护。 - **构建科学护栏**：搭建有效的安全护栏需要深谙 AI 技术本身。模型构建是“艺术与科学的结合”（a combination of art and science），管理者必须透彻理解模型机理与缺陷。 - **恪守责任与“人在回路”（Human-in-the-loop）**：无论使用何种工具——无论是纸笔、Excel 还是生成式 AI——最终输出结果的责任始终由人来承担。使用者必须对模型输出保持验证责任，确保人始终处于关键决策链路中。 - **以 AI 治理 AI**：积极拥抱先进技术，学会运用 AI 工具自身来高效监测、防御并化解 AI 带来的风险。 ## Notable quotes > [00:04](https://www.youtube.com/watch?v=fKXJhDljLTc&t=4s) 大家之所以能够在滑梯与草地上无拘无束、欢快地自由奔跑，核心前提是游乐场四周安装了坚固的安全护栏。 — Jenny Yu > [03:13](https://www.youtube.com/watch?v=fKXJhDljLTc&t=193s) 残余风险 (Residual Risk) = 固有风险 (Inherent Risk) - 控制措施 (Controls / Guardrails) — Jenny Yu > [05:39](https://www.youtube.com/watch?v=fKXJhDljLTc&t=339s) 并非所有 AI 生而平等。 — Jenny Yu > [05:39](https://www.youtube.com/watch?v=fKXJhDljLTc&t=339s) 伴随模型全周期的两大核心风险在于：错误开发（Incorrect Development）与不当使用（Inappropriate Use）。 — Jenny Yu > [08:28](https://www.youtube.com/watch?v=fKXJhDljLTc&t=508s) 如果核心假设发生变动，输出结果将产生何等剧烈的震荡。 — Jenny Yu > [14:56](https://www.youtube.com/watch?v=fKXJhDljLTc&t=896s) 绝不能仅仅停留在对系统整体输出的粗放监控上，而是必须穿透并深入到每一个单独的 Agentic AI 中，对其运行性能与行为表现进行独立、细致的监测。 — Jenny Yu > [15:41](https://www.youtube.com/watch?v=fKXJhDljLTc&t=941s) 生成式 AI 在实际应用中往往是一个“更深的黑盒”。 — Jenny Yu > [18:34](https://www.youtube.com/watch?v=fKXJhDljLTc&t=1114s) 如果我站上体重秤称出 130 磅，这个数字可能无法直接用于严苛的医疗诊断，因为我并不知道这台秤的绝对精度究竟如何。但有一件事我是确定的：如果你和我站上同一台秤称出 150 磅，那你一定比我重；如果我今天称是 130 磅，明天称变成了 150 磅，那说明我确实变胖了。 — Jenny Yu > [20:31](https://www.youtube.com/watch?v=fKXJhDljLTc&t=1231s) 模型构建是艺术与科学的结合，管理者必须透彻理解模型机理与缺陷。 — Jenny Yu > [20:31](https://www.youtube.com/watch?v=fKXJhDljLTc&t=1231s) 无论使用何种工具——无论是纸笔、Excel 还是生成式 AI——最终输出结果的责任始终由人来承担。 — Jenny Yu ## Mentioned Jenny Yu, FHLBank Topeka (Federal Home Loan Bank of Topeka), SR 11-7, Wall Street, Agentic AI, Generative AI, Excel ## Video description Jenny Yu, Director, Model Risk Management and Methods, Federal Home Loan Bank Topeka Abstracts Not all AIs are created equal—and neither is AI risk management. This talk provides a practical blueprint for risk leaders and AI practitioners to build robust AI risk management programs by leveraging a trusted source: the proven framework of Wall Street. Drawing on 20+ years of experience in model risk management within the highly regulated financial industry, Jenny will use the time-tested three-pillar framework—governance, owners' responsibility, and independent validation—to demonstrate how to adapt these principles to today's complex AI systems. Attendees will leave with actionable strategies and a clear framework to help them embrace AI safely, confidently, and effectively, cutting through the complexity and hype to focus on the most impactful and measurable approaches to managing AI risk across all industries. [Source](https://www.youtube.com/watch?v=fKXJhDljLTc)

Source quotes

[0:04] Jenny Yu: 大家之所以能够在滑梯与草地上无拘无束、欢快地自由奔跑，核心前提是游乐场四周安装了坚固的安全护栏。 [3:13] Jenny Yu: 残余风险 (Residual Risk) = 固有风险 (Inherent Risk) - 控制措施 (Controls / Guardrails) [5:39] Jenny Yu: 并非所有 AI 生而平等。 [5:39] Jenny Yu: 伴随模型全周期的两大核心风险在于：错误开发（Incorrect Development）与不当使用（Inappropriate Use）。 [8:28] Jenny Yu: 如果核心假设发生变动，输出结果将产生何等剧烈的震荡。 [14:56] Jenny Yu: 绝不能仅仅停留在对系统整体输出的粗放监控上，而是必须穿透并深入到每一个单独的 Agentic AI 中，对其运行性能与行为表现进行独立、细致的监测。 [15:41] Jenny Yu: 生成式 AI 在实际应用中往往是一个“更深的黑盒”。 [18:34] Jenny Yu: 如果我站上体重秤称出 130 磅，这个数字可能无法直接用于严苛的医疗诊断，因为我并不知道这台秤的绝对精度究竟如何。但有一件事我是确定的：如果你和我站上同一台秤称出 150 磅，那你一定比我重；如果我今天称是 130 磅，明天称变成了 150 磅，那说明我确实变胖了。 [20:31] Jenny Yu: 模型构建是艺术与科学的结合，管理者必须透彻理解模型机理与缺陷。 [20:31] Jenny Yu: 无论使用何种工具——无论是纸笔、Excel 还是生成式 AI——最终输出结果的责任始终由人来承担。

Source quotes

[0:04] Jenny Yu: standing between you and your lunch [0:04] Jenny Yu: strategic enabler [0:04] Jenny Yu: freely and happily [5:39] Jenny Yu: not all AIs are created equal [7:10] Jenny Yu: business purpose [7:10] Jenny Yu: business use [7:10] Jenny Yu: tone at the top [15:41] Jenny Yu: an even blacker box [17:14] Jenny Yu: A very critical question you want to ask: what training data did they use, and how is it relevant to your business? For example, if they use the model to extract financial data from PDF files, it might not be good at drafting a lease for you. [18:34] Jenny Yu: If I try to find my weight, I can stand on a scale and get 130. That number cannot be used for medical purposes, because I don't know how accurate the scale is. But there's one thing I know: if you stand with me using the same scale and you weigh 150, you are heavier than me... and if my weight is 130 today and tomorrow is 150, it means I gained weight. [20:31] Jenny Yu: As an individual, it doesn't matter if I use pen and paper, or I use Excel, or I use generative AI—if you provide the number, I hold the responsibility. I need to verify that.

Original transcript

[0:04] Good afternoon everyone. Thank you for [0:06] being here. I know I standing between [0:08] you and your lunch. I really appreciate [0:10] your time. Um [0:13] I work for financial industry for 20 uh [0:16] plus year. uh today I want to share with [0:18] you uh AI framework has been used in [0:22] financial industry for 20 years and um [0:26] is is a framework to manage blackbox [0:30] risk. [0:34] So I started to emphasize the a [0:38] practical and uh uh effective AI risk [0:43] management framework is a strategic [0:46] enabler. I'll provide some background [0:50] uh which is shapes how I approach AI [0:53] risk management. [0:56] I will walk you through those frameworks [0:59] and that that works in the financial [1:02] industry. And I will start um with a [1:05] call um risk equation. And I was [1:12] um [1:14] like we all know uh not AI are created [1:18] equal based on how their categorization [1:21] and their um [1:25] usage and different risk are involved [1:29] and um the AI risk management will be [1:33] different [1:36] and So [1:39] finally I will share some [1:42] AI tools which was was important [1:46] uh about those tools and uh I I'll give [1:49] uh some takeaway at the end. [1:53] Um [1:55] so uh I put a a [1:59] a picture of the playground. You can see [2:02] kids can running around freely and [2:04] happily because they the guard rail [2:07] around the playground. [2:09] And this is um um [2:13] we we is is the same with the AI risk [2:16] management. The effective AI risk [2:19] management can empower business leader [2:22] to you use AI safely and confidently. [2:30] Um and I said uh financial industry has [2:34] a framework to manage the blackbox risk [2:38] for about 20 years [2:42] and a lot of the the when framework [2:46] started it was not forcefully emphasized [2:50] until financial crisis. [2:54] A lot of financial logic institution [2:58] they build uh their frameworks [3:02] those framework can offer some practical [3:04] lessons we could leverage to manage AI [3:07] risk. [3:13] Um so I started as a data scientist and [3:17] I have a 20 years experience to develop [3:21] model manage model and uh in manage AI [3:24] machine learning model risk. [3:28] I have worked with many different model [3:31] using AI risk management using risk [3:34] management in investment strategy and [3:36] operational efficiency. [3:39] I can bridge the gap because I see so [3:41] many model can bridge the gap between a [3:43] data algorithm and a business process [3:45] and a strategy [3:48] which allow me to to be a strategic [3:50] enabler to empower leaders to use all [3:54] kind of tools. [3:57] Um here is the uh foundational equation [4:02] for risk. So most of the time we talk [4:05] about the inherit risk which how [4:08] complicated your model is how um what [4:12] impact it has and uh at the same time [4:16] you can have a certain controls around [4:18] it uh you can build some gui uh guard [4:21] area around it. I'll share with you [4:23] later about what kind of ger you can [4:26] build based on what kind of risk you it [4:29] evokes [4:30] and and how to minimize the residual [4:33] risk is the risk you uh left uh you need [4:39] um build a strategy around it and to [4:43] basically to tolerate [4:46] tolerate it. Um [4:49] like I said very very critical to [4:52] understand [4:54] what risk your AI get invoked uh the [4:58] potential consequence [5:00] and the magnitude and the likelihood it [5:02] will happen [5:05] and and what control you can build [5:07] around it. The reason I emphasize why [5:09] did you need a when people talk about [5:12] our AI risk they just feel that's [5:14] something so uh significant is um [5:19] unmanageable but if you [5:23] look deeply about what risk it actually [5:26] involve particular related to generative [5:28] AI it's nothing new if what kind of new [5:31] risk the generative AI bring to the [5:34] table how we can manage it from Yeah. [5:39] Um so uh like I said earlier not AI are [5:44] created equal and uh um so based on the [5:49] uh I put them into the uh different [5:53] bucket because different risk is [5:56] involved and the different risk [5:59] management [6:01] is uh will be uh in place to manage [6:06] those risk. I put it into three bucket. [6:09] One is the traditional AI which evolve [6:12] machine learning, statistical, [6:13] stochastical tools and the second [6:16] category would be generative AI. The the [6:19] third category is other AI like you use [6:22] vendors models you don't know what's [6:24] involved if AI is involved. Um so for [6:28] traditional AI it's like you do [6:30] forecasting you you cannot [6:35] manually verify it so you need another [6:39] to you you need either do back testing [6:42] you do benchmark testing you need to [6:44] find a tool to do it for the generative [6:47] AI depend how you use this a lot of [6:50] times it enhance the human process human [6:54] actually have been go through that human [6:56] can verify it. [6:58] And the last part is like you it's about [7:01] the vendor risk. You need to ask a right [7:04] question related to the AI. [7:10] Um so this what I created the holastic [7:13] modeling uh process [7:16] all those modeling all those black boxes [7:19] always started with business purpose [7:22] and it end with a business use. How [7:27] So the risk associated with any of those [7:30] model is in incorrectly development and [7:34] the inappropriate use. [7:39] Like I said that those traditional AI [7:42] tools they they are blackbox they cannot [7:45] be uh often cannot be verified by human [7:50] manually. So they need a special way to [7:53] control that risk. [7:58] You you can see in those modeling [8:00] process you have a business objective [8:02] then you have collect data you [8:03] pre-process data you have whole modeling [8:06] process you know the tradeoff to those [8:09] bias variance and and the performance [8:12] and then you have a model output you [8:14] monitor the model output and you [8:17] disclose the risk limitation those tools [8:21] are powerful you need to know what they [8:23] can do what they cannot view. [8:28] So this this is uh follow the SI11 which [8:32] is the uh financial regulatory uh [8:35] guidance on model risk management. We [8:38] build these three pillars uh framework. [8:41] The first one is the governance is talk [8:45] about our policy and the procedure rules [8:47] and responsibility. [8:49] One thing I want to mention that this is [8:53] specific mentioned the tone has to set [8:56] on the top. What kind of risk tolerance [8:58] you have as a bank as an organization [9:00] had to set on the top and is balance the [9:04] the risk and the return and can for the [9:08] efficient and effective you gain would [9:11] you really are you willing to take that [9:14] risk. [9:15] Um the the second part is like you [9:18] identify what's called the model and [9:21] then you put them you assess the risk [9:24] put into the different bucket depend on [9:26] the complexity uh depend on the impact [9:29] to your business and you have a [9:31] different level of control around it [9:34] like for financial industry these the [9:36] last of uh uh pillow would be [9:41] independent validation those risk [9:43] assessment will frame how frequently you [9:46] validate a model and what's the scope of [9:49] your validation. [9:52] And the last part is you know you you [9:54] need to have ongoing monitoring in your [9:56] model performance. You work today might [9:58] not work uh tomorrow. And uh also you [10:03] you know we report a model risk [10:07] management just as a uh [10:11] uh as a part of uh the overall [10:15] enterprise risk management. Uh [10:18] it is every quarter we reported the the [10:22] risk to the to the board. And the second [10:25] part is more for model owners. Whoever [10:28] owns the model, they have to make sure [10:31] this mo model owner can be model [10:34] developer. But if you use a model mo [10:36] vendors, you are the owner. They you you [10:39] have to work with developer the vendor [10:41] to make sure you know during that [10:44] developmental stage um implemented [10:46] stage. You have a a testing of model [10:50] performance. You track model [10:52] performance. If there's a significant [10:54] change, you need to do something about [10:56] it. [10:57] Um and also you have you need to have [11:00] the document so so the the the logic [11:03] stays there's a transparency with that [11:06] the last app was be independent [11:08] validation like I shared earlier there's [11:11] a whole model component for data input [11:14] to to output it the model input um [11:19] validation need to cover all those [11:21] elements by the regulation but in [11:24] practical a lot like the the bank I work [11:27] with uh or most of banker outside our [11:30] size is that we use vendors model to [11:33] manage the in risk um um uh credit risk [11:38] but our team [11:41] are the data scientist the and [11:45] um and the computer science engineer um [11:50] states so they were able to replicate a [11:53] lot of them replicate the the vent model [11:56] and uh and disclose those [12:00] risk limitation to the management. [12:02] Sometimes if you change your assumption [12:05] the the model result can change [12:06] dramatically. So have those [12:09] understanding communication to the [12:11] senior management about the model is [12:13] very important. [12:16] So I'll give an example that's a lot of [12:20] information in that that page. I give [12:22] you a specific example how we do it [12:26] there and and if we apply the same can [12:30] if we can apply the same principle to [12:33] the uh uh genative AI a genetic AI so we [12:38] we so it's a simple model we want to [12:41] know our uh interest rate income so [12:45] income you know if I learn uh learn some [12:48] $100 you ch if I charge 60% interest [12:51] rate [12:52] at the end I have income $6. [12:55] So for in in reality those interest rate [12:58] and the balance sheet forecasting are [13:00] very complicated. We need a model to do [13:02] that. Uh one of as I mentioned we we we [13:06] have to have a risk assessment put in [13:09] the model inventory and we have to do [13:13] the validation particularly in this case [13:15] we have a back testing we have a ground [13:17] to choose. So we compare the income [13:20] itself. We also compare the each element [13:24] interest rate and and the balance sheet [13:28] to see if there's a gap between the [13:31] model and the [13:34] and and the historical data actual data [13:38] where where where they come from. So the [13:41] most important part we have a [13:43] performance monitoring through the time [13:46] and the model performance will tie to [13:48] risk tolerance define set up by the city [13:52] management. They said if they said that [13:54] oh if you you you miss forecast by 5% [14:00] you're fine you know model always have [14:02] some like fluctuation or or error we [14:04] accept that if you rate the forecasting [14:07] is more than 1% [14:11] within 1% that probably okay so the the [14:14] the senior management from business side [14:17] to set up the tolerance [14:21] to see how much risk we we we tolerance [14:24] based on the the gain from using the [14:26] model. [14:28] If you think about [14:30] that simple equation, we make it a three [14:34] aentica AI. We need a AI to say this. I [14:40] I give you my balance sheet. Can you [14:41] calculate the income for us? And then we [14:45] have another generative AI to say can [14:48] you you know based on the information [14:51] you know you can you go find the [14:52] relatable rate the the interest rate is [14:56] a very complicated calculation it is we [14:59] we do not direct get a get from [15:01] internet. So, so, so you think about you [15:05] have another aentic AI to help us to [15:09] manage the rate and then you have a [15:11] third um aenic AI to this is a [15:16] oversimplified [15:18] uh uh way to to just explain how those [15:21] framework can work with large language [15:24] model. So the last part is is balance. [15:27] you always be able to find those [15:30] performance monitoring and then you do [15:32] not just do overall you go through each [15:35] a genetic AI. [15:39] Um [15:41] so uh now we talk about a uh uh [15:46] generative AI what I I I was doing is a [15:49] even blacker box. So you might know some [15:54] of the data depend how you if you fit [15:56] your own data a lot of times you you you [16:00] if you just direct use a logic language [16:01] model you don't have your own data [16:05] there's not a whole lot of control you [16:07] you can have what I try to say for [16:10] generative AI there's a lot of risk [16:13] related and we have two minutes left um [16:18] so what what I'm trying to say is the [16:21] new risk risk that a generate uh [16:24] generative AI introduc is those [16:26] hallucination and the incuracy and the [16:28] data bridge. [16:31] So, so [16:33] a what I would want to say for those two [16:36] type of a risk there's a lot of existing [16:41] um policy procedure in a bank or in in [16:45] organization [16:47] you have a like a data data risk [16:49] governance which uh and then you have a [16:51] cyber security they take care of a [16:53] traditional data bridge the only data [16:56] bridge from large language model because [16:59] you have that chartback you have a [17:00] interact action. They could have a [17:02] malicious prompt. If you realize that's [17:06] the data bridge risk, you can have a [17:09] tool to prevent it from happen. So, [17:14] um for for a if if you use more advanced [17:18] you you have your internal data in both [17:21] there could be another data bridge from [17:23] from there. Um and the if you use a [17:27] special logic language model you know [17:29] you use a vendor's model are very [17:33] critical question you want to ask what [17:35] are training data are they use how they [17:38] are relevant to your business for [17:41] example if you use you use they use that [17:44] to abstract financial data in the PDF [17:47] file they might not good at uh at a [17:50] draft the lease for you. So, so those [17:53] are how data closely relate to your [17:56] business is very critical and even even [17:59] you can ask how in those area are model [18:03] performance overall they have a one [18:05] model performance but for the specific [18:07] se sector do they have that that [18:10] performance for it. Um same thing for [18:14] the vendor model you would say do they [18:16] use AI do they collect your data do they [18:22] put your data into training if they [18:25] don't do what what what do they do [18:27] anything [18:29] prevent your data from bridge if you if [18:32] you concern about it [18:34] um so uh for generative AI tool uh it [18:40] I'm not giving up the tool because the [18:42] tool or are very individualized [18:45] depend on the risk you have. What what I [18:48] want to say they was for effective tool [18:51] it has to be easy to use. They just act [18:54] you if you give them they access your [18:56] API they will able to do the work. They [18:59] should be automatic give you timely [19:01] feedback and they should be evolve [19:03] evolving because AI [19:06] uh you know move so fast and and uh [19:13] it's very [19:15] uh important that those um tools are not [19:20] invasive. So they know do not need to [19:23] access to your models internal [19:27] mechanism. So they can run the test from [19:30] outside. Um so another point I want to [19:35] mention is the precision and the [19:37] relativity in comparison. So if I uh try [19:42] to find my weight I can stand on scale I [19:44] got a 130 that number is not cannot be [19:49] used for medical because I don't know [19:50] how accuracy is the scale but there's [19:54] one thing I know if you stand with me [19:58] use the same scale if you weigh 150 [20:02] you are you are [20:05] you are heavier than me that I I I and [20:09] say if my weight is 130 today and [20:12] tomorrow is 150 [20:15] which means I gain the weight. So those [20:18] relativity in comparison is is very [20:21] valuable accuracy to some degree when [20:24] when you select a model you can make [20:26] that comparison use the same tool. [20:31] So the takeaway is you know [20:36] the tongue has to set up from the top to [20:41] and and then I understand the what risk [20:45] AI evoked and their magnitude and the [20:48] likelihood and the balance of risk [20:51] return. There's one thing is for data [20:53] bridge if like for our bank sometime we [20:57] put the information there I I don't [20:58] think nobody bother to use the computing [21:01] power to hack our number so the risk is [21:04] a very very minimum um and the other [21:09] thing is to build a guard rail you have [21:11] to understand the AI [21:14] you know I was a model developer I read [21:17] so many models so I know what the it's a [21:20] combination art and science. Um the [21:24] other things there's a lot of existing [21:26] guidance privacy you know as an [21:29] individual it doesn't matter I use pen [21:31] or paper or I use Excel I use generative [21:34] AI if you give the number I hold a [21:36] responsibility I need to verify that [21:40] always keep me in the loop and uh [21:43] leverage AI to to manage the risk. Thank [21:46] you. [21:47] [Applause]