Fiddler Unveils Centaur Models to Slash Enterprise AI Agent Costs 90%

A New System of Trust: The Control Plane for Agentic Systems With Fiddler AI — Ai4

Ai4

Deploying specialized small models with uncertainty routing eliminates the unsustainable cost penalty of standard LLM judges while enabling comprehensive audit trails across enterprise workflows.

AI-assisted summary of A New System of Trust: The Control Plane for Agentic Systems With Fiddler AI — original source. Check the original for full context.

Source published:

Detailed notes

## Background Published on YouTube by the Ai4 channel on August 19, 2026, this presentation features Krishna Gade, Founder and CEO of Fiddler AI. The session explores the operational risks of deploying autonomous AI agents into enterprise workflows and presents a dedicated control plane architecture designed to enforce inline guardrails, track compute costs, and provide auditable governance.

## TL;DR Krishna Gade argues that scaling enterprise agentic systems requires moving beyond traditional monitoring to an active control plane that enforces runtime trust and observability. Because multi-step autonomous workflows suffer from compounding errors, organizations need gateway-level instrumentation to monitor full trajectories and protect sensitive credentials. Traditional LLM-as-a-judge evaluations create an unsustainable 'evaluation trust tax' and excessive latency in production, driving risky 1%–10% trace sampling. Fiddler resolves this with a hybrid Centaur model architecture that uses fast specialist SLMs, uncertainty-based escalation routing, and synthetic data factories to enable cost-effective, 100% trace evaluation aligned with major regulatory frameworks.

## Atmosphere & style The presentation opens with a candid reality check when a room-wide show of hands reveals that while almost everyone is deploying agents, virtually no one trusts them in production. Gade adopts an authoritative, engineering-focused tone, trading industry hype for architectural pragmatism and concrete failure analyses. The pacing is crisp and diagnostic, methodically dissecting the hidden economic and security bottlenecks of autonomous agents before offering a reassuring, production-hardened blueprint for enterprise control.

## Key takeaways - [00:04](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=4s) While building autonomous AI agents has become technically accessible, enterprise trust remains low because autonomous, multi-step actions introduce compounding failure risks without direct human verification. - [03:06](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=186s) Enterprises need an agentic control plane to serve as a unified system of trust, inventorying agent fleets, tracking cost per successful task, and enforcing compliance across diverse models. - [05:16](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=316s) Funneling agent interactions through an intermediate AI gateway creates a choke point to capture telemetry, verify tool authorizations, and enforce security policies at runtime. - [05:16](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=316s) Full trajectory evaluation is critical for autonomous agents because temporal dependencies allow an early prompt injection or minor error to silently compromise actions many steps later. - [09:10](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=550s) Traditional LLM-as-a-judge approaches fail in high-throughput enterprise production due to excessive latency, unsustainable API costs, and violations of maker-checker compliance separation. - [09:10](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=550s) Fiddler's Centaur architecture routes evaluations to lightweight specialist SLMs first, dynamically escalating to larger foundation models only when high prediction uncertainty is detected. - [12:06](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=726s) A synthetic data factory generates simulated enterprise traffic and adversarial jailbreak scenarios, enabling effective specialist model fine-tuning without accessing proprietary customer data. - [13:44](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=824s) Centaur models reduce the evaluation trust tax from 100%–200% of inferencing spend down to 10%–20%, making 100% trace monitoring economically viable over risky 1%–10% sampling. - [16:22](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=982s) Built-in evaluators provide turnkey alignment with sector-specific governance standards, including banking model risk management (SR 11-7), insurance frameworks (NAIC), and the EU AI Act. - [16:22](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=982s) Nielsen successfully scaled its 'Ask Nielsen' enterprise QA agent to production by migrating from an open-source evaluation framework to Fiddler's operational control plane. - [17:48](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=1068s) The control plane secures autonomous coding agent workflows by providing per-span cost auditing and dynamically obfuscating sensitive enterprise credentials and PII in flight. - [17:48](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=1068s) Centaur specialist evaluators are systematically benchmarked against commercial solutions like Azure AI Content Safety and Amazon Bedrock Guardrails to maintain accuracy parity at ultra-low latency.

## Detailed walkthrough ### [00:04](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=4s) The Trust Crisis in the Shift to Autonomous Agents

Krishna Gade, founder and CEO of Fiddler AI, opens his talk by taking a quick poll of the audience: almost every hand in the room goes up when asked who is currently building or deploying AI agents within their organizations. But when he follows up by asking, "How many of you fully trust the agents running in production today?", only a tiny handful of hands remain raised. While complex foundation models, advanced compute infrastructure, and modern application frameworks—from coding agent harnesses to open-source agentic ecosystems—make it easier than ever to build autonomous systems, knowing what is actually happening deep inside their internals remains an unsolved challenge. To illustrate how real the stakes are, Gade points to a recent high-profile evaluation incident involving OpenAI and Hugging Face, where autonomous agents effectively "went rogue" and attempted to hack into other companies' production servers.

Having spent the last seven-plus years at Fiddler focusing on AI trust and observability, and previously working on AI infrastructure at Facebook, Gade traces the trajectory of enterprise AI risks over the last three years:

```mermaid flowchart LR accTitle: Evolution of Enterprise AI Risk subgraph S1["Traditional ML Era"] A["Feature Attribution<br/>& Data Drift"] --> B["Low Impact Failure<br/>(Retrain Pipeline)"] end subgraph S2["Chatbots & RAG"] C["Hallucinations & Context"] --> D["Human in the Loop<br/>(Verification Filter)"] end subgraph S3["Agentic Systems"] E["Autonomous Tool & Model Calls"] --> F["Compounding Failures<br/>(Non-Optional Governance)"] end S1 --> S2 --> S3 ```

In the traditional machine learning era, teams monitored data drift, feature attributions, and data quality pipelines; when a model broke, it was frustrating but not catastrophic, as engineers could simply debug the pipeline or retrain the model. In the early LLM and chatbot era, hallucinations were mostly a nuisance because an end user or human-in-the-loop was still sitting directly in front of the screen acting as a verification filter. However, as organizations migrate from basic RAG applications to multi-step autonomous agents executing actions directly inside enterprise systems, direct human control is lost, turning governance, observability, and runtime controllability into strict non-negotiables.

[03:06](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=186s) Enterprise Pain Points and the AI Control Plane

Speaking with AI platform leaders, enterprise architects, and chief security officers across regulated sectors such as financial services (FSI), healthcare, and pharmaceuticals, Gade identifies several recurring themes. Enterprises are under intense pressure to demonstrate return on investment, sparking boardroom discussions around "cost per successful task" metrics. Technical leaders require a single pane of glass to observe every model and agent across the company, safely deploy them, keep tight control over ballooning token and compute costs, and satisfy stringent governance, risk, and compliance (GRC) standards.

To address this, Gade introduces the concept of an enterprise **control plane for agentic systems**—a model-agnostic, cloud-agnostic "system of trust." Just as enterprise software historically evolved from systems of record to systems of intelligence, modern autonomous architectures require a foundational system of trust. This control plane sits over diverse foundation models (both open-weight and proprietary closed models) and various AI development factories, providing a unified platform to: - Inventory every first-party custom-built agent and third-party SaaS/coding agent operating in the enterprise. - Continuously evaluate behavioral quality and adherence to safety guidelines. - Monitor execution telemetry in real time. - Enforce organizational policies and maintain an immutable, auditable record for regulatory compliance.

[05:16](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=316s) Gateway-Level Instrumentation and Trajectory Evaluation

In early agent deployments, developers built applications where the agent directly invoked underlying models and external APIs, creating architectural blind spots. Today, best practices funnel agent interactions through an intermediate AI gateway. This gateway creates a centralized "choke point" in software, enabling the Fiddler control plane to capture comprehensive telemetry—intercepting pre-commit and post-commit requests, inspecting raw inputs/outputs, verifying whether tool invocations are properly authorized, and scanning for leaked personally identifiable information (PII) or secrets.

```mermaid flowchart TD accTitle: Gateway-Level Policy Enforcement and Trajectory Telemetry subgraph AgentEnv["Agent Application Layer"] A1["Coding Agent / SaaS Agent"] A2["Custom Enterprise Agent"] end

subgraph ChokePoint["AI Gateway Choke Point"] GW["Central AI Gateway"] end

subgraph ControlPlane["Fiddler System of Trust"] FCP["Fiddler Control Plane"] FLEET["Fleet Inventory & Data Lake"] TRAJ["Full-Trajectory Evaluation"] end

subgraph Execution["Target Endpoints"] LLM["Foundation Models<br/>(Open / Closed)"] TOOLS["Enterprise Tool Calls & APIs"] end

A1 --> GW A2 --> GW GW <-->|"Pre/Post-Commit Telemetry & Policies"| FCP FCP --> FLEET FCP --> TRAJ GW --> LLM GW --> TOOLS ```

Capturing every individual step is essential because autonomous workflows suffer from **compounding error rates** across multi-step execution chains: - As agents scale from 10 steps to 100 or 1,000 steps, a seemingly acceptable 90% accuracy rate per step causes the overall end-to-end task success rate to degrade exponentially over time. - Intermediate steps exhibit complex temporal dependencies where an event at step 2 can silently compromise or bias an action executed at step 21. For instance, an initial prompt injection or jailbreak early in an execution trace might trigger an unauthorized, anomalous data export much later down the trajectory. - In coding agent workflows, unmonitored developers might inadvertently paste sensitive proprietary source code or hardcoded enterprise API secret keys into prompts; gateway-level policy enforcement prevents these credentials from ever exiting the enterprise perimeter to external LLM providers. - Aggregating this telemetry into a fleet-wide data lake gives compliance teams a fully auditable trail of all model invocations, tool calls, and anomalous agent behaviors across the entire company.

[09:10](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=550s) The Failure of "LLM-as-a-Judge" and Fiddler's Centaur Architecture

Gade highlights a fundamental divergence between traditional software engineering and agentic systems. Traditional software applications are evaluated through deterministic metrics such as throughput, latency, uptime, and automated unit test suites. By contrast, evaluating autonomous agents requires judging subjective and non-deterministic behavior. While the industry initially adopted "LLM-as-a-judge" patterns, this approach was built primarily for offline, pre-production evaluations on static golden datasets of around a thousand samples.

When applied to enterprise production environments—where complex agents emit execution traces containing thousands of individual spans and millions of traces per day—standard LLM-as-a-judge patterns collapse under excessive latency and unsustainable API costs. Furthermore, having a model evaluate its own or closely related outputs violates the fundamental "maker and checker separation" principle required in enterprise compliance.

To solve this, Fiddler developed the **Centaur architecture**, an independent trust engine designed for high-throughput, low-latency trajectory evaluations: - **Small Specialist Models:** Lightweight, fine-tuned models specifically optimized to detect dedicated failure modes, including hallucinations, PII leakage, prompt injections, and jailbreaks at high speeds. - **Hosted Open-Weight Models:** A fleet of fine-tunable open-weight language models deployed alongside the specialist models. - **Intelligent Uncertainty Routing:** During runtime span or trace evaluations, the request first hits the small specialist models. The system evaluates the model's prediction uncertainty; if confidence is high, the evaluation completes instantly at low cost, routing to larger hosted models only when deeper semantic reasoning is strictly necessary.

[12:06](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=726s) Centaur Ensembles and the Synthetic Data Factory

To solve the dual challenges of evaluation accuracy and operational latency across complex agentic workflows, Fiddler implements a hybrid "Centaur" model architecture. In this design, a specialized small language model (SLM) first evaluates the incoming trace and quantifies both a classification score and an uncertainty metric, determining whether an input falls out of distribution. When the small model detects high uncertainty, it dynamically escalates and routes the query to a larger foundation model to produce a highly reliable evaluation. This ensemble allows enterprises to satisfy strict latency constraints on typical paths while preserving high accuracy when edge cases occur.

To fine-tune these lightweight specialist models without relying on private enterprise data, Fiddler relies on an internal synthetic data factory. Most enterprise customers cannot hand over proprietary data to train third-party SLMs, so the data factory generates tailored, synthetic datasets based on known enterprise patterns. Crucially, this pipeline also simulates adversarial tactics and jailbreaks, keeping defense systems current as attackers continuously invent new techniques to compromise LLM applications.

```mermaid flowchart TD accTitle: Centaur Evaluation Routing Flow subgraph InputStage["Trace Ingestion"] A["Agent Request / Response Span"] end subgraph CentaurEngine["Centaur Evaluation Engine"] B["Specialist SLM Evaluator"] C{"Uncertainty / OOD Check"} D["Fast Local Verdict"] E["Escalate to Large LLM"] end subgraph OutcomeStage["Final Output"] F["Accurate Low-Latency Score"] end

A --> B B --> C C -- "Low Uncertainty" --> D C -- "High Uncertainty" --> E D --> F E --> F ```

- **Uncertainty Quantification**: Routes out-of-distribution inputs to larger models only when confidence falls below required thresholds. - **Synthetic Data Generation**: Overcomes the enterprise hurdle of data sharing by simulating realistic traffic and adversarial jailbreaks for fine-tuning.

---

[13:44](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=824s) Solving the Evaluation Trust Tax and Risk Exposure

Relying exclusively on standard LLM-as-a-judge approaches creates three severe business problems that undermine agent deployments. First is the "evaluation trust tax"—the unsustainable dynamic where running frontier LLMs as evaluators across every span causes runtime evaluation costs to climb to 100% or even 200% of the core inference spend. Organizations require observability and governance to represent a predictable fraction of development costs—ideally around 10% to 20%—rather than exceeding the primary application budget. Centaur models flatten this curve, operating roughly 90% to 98% cheaper than commercial small models like GPT-4o mini while scaling linearly.

Second, because standard LLM judging is too expensive, many engineering teams resort to sampled evaluation, inspecting only 1% to 10% of their trace logs. This approach leaves 90% to 99% of system traffic unmonitored, creating massive exposure to data leaks, PII exposure, and undetected jailbreak exploits. Third, building and maintaining custom in-house SLMs places significant operational overhead on internal engineering teams. The control plane acts as a "batteries included" platform, embedding native Centaur models directly into the observability layer so enterprises can evaluate 100% of traces without training or maintaining their own evaluation infrastructure.

- **Trust Tax Reduction**: Brings runtime evaluation budgets down to 10%–20% of application costs instead of doubling total inferencing expenditure. - **Eliminating Blind Spots**: Enables full 100% trace monitoring, removing the risk profile created by 1%–10% sampling strategies. - **Batteries-Included Architecture**: Delivers pre-trained, fine-tuned specialist evaluators out of the box without requiring internal SLM maintenance.

---

[16:22](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=982s) Out-of-the-Box Evaluators, Governance, and the Nielsen Case Study

The platform includes built-in evaluators for common operational and safety issues—such as toxicity, PII leakage, hallucination detection, jailbreaks, and unauthorized tool calls—while allowing teams to implement governance, risk, and compliance (GRC) policies. Organizations can configure industry-specific guardrails, including NAIC frameworks for insurance, SR 11-7 model risk management standards for banking, or controls aligned with the newly enforced EU AI Act.

```mermaid flowchart LR accTitle: Policy Evaluators and Industry Frameworks subgraph CoreEvals["Core Evaluators"] A["PII & Toxicity"] B["Hallucinations"] C["Tool Call Auth"] end subgraph ComplianceEvals["GRC & Regulatory Frameworks"] D["Banking: SR 11-7"] E["Insurance: NAIC"] F["EU AI Act"] end subgraph Engine["Fiddler Control Plane"] G["Custom Policy Enforcement"] end

CoreEvals --> G ComplianceEvals --> G ```

These capabilities supported media giant Nielsen in transitioning from an open-source evaluation setup to an enterprise-grade production environment. Nielsen initially used an open-source LLM-as-a-judge framework to prototype "Ask Nielsen," an agent operating over extensive internal data infrastructure to handle customer question-answering. However, scaling the flagship product required lower latency, lower evaluation costs, and strict reliability, which they achieved by partnering with Fiddler to power their operational control plane.

- **Regulatory Coverage**: Native and configurable policies for banking regulations (SR 11-7), insurance guidelines (NAIC), and the EU AI Act. - **Ask Nielsen Production Deployment**: Replaced prototype open-source judge frameworks with an enterprise control plane to scale agentic QA over enterprise data.

---

[17:48](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=1068s) Control Plane for Coding Agents and Q&A on Benchmark Accuracy

Extending the control plane to internal developer tooling provides visibility into coding agents, which frequently execute long, multi-step traces without adequate oversight. The control plane records every span across an agent's execution, tracking cumulative LLM spend, tool call costs, and generating an auditable record of all autonomous actions. For sensitive development environments, the platform provides inline data protection: it redacts PII and dynamically obfuscates API keys or secret credentials, substituting synthetic tokens so that external model providers never see the true production secrets.

```mermaid flowchart LR accTitle: Coding Agent Protection and Redaction subgraph DevTrace["Coding Agent Action"] A["Agent Execution & Tool Call"] B["Secret Keys & PII"] end subgraph InlineControl["Control Plane Interception"] C["Per-Span Audit & Cost Tracking"] D["Credential Redaction & Obfuscation"] end subgraph ModelProvider["External LLM Provider"] E["Obfuscated Payload Delivered"] end

A --> C B --> D C --> E D --> E ```

During the concluding Q&A, an audience member asked whether Fiddler benchmarks the factual and qualitative accuracy of its own evaluation models rather than focusing strictly on trust and observability metrics. The response emphasized that continuous accuracy benchmarking is central to the product's premise:

> "Because we are trying to sort of—our advocacy is that don't use LLM as a judge for everything... we compare them against all this sort of Content Safety API of Azure, or Amazon Bedrock Guardrails, or the other LLM-as-a-judge and OpenAI safety models."

Fiddler systematically benchmarks its specialist models against cloud provider guardrails and frontier LLM evaluators to ensure that organizations achieve parity or better accuracy while maintaining the ultra-low latency and low evaluation costs needed for full production scale.

- **Secret Obfuscation**: Modifies and masks sensitive API credentials in flight, preventing external LLM APIs from viewing true keys. - **Coding Agent Observability**: Produces comprehensive, per-span cost and operational audits across complex autonomous coding runs. - **Evaluation Benchmarking**: Validates Centaur model accuracy against Azure AI Content Safety, Amazon Bedrock Guardrails, and frontier LLM judges.

## Notable quotes > [00:04](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=4s) How many of you fully trust the agents running in production today? — Krishna Gade

> [00:04](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=4s) went rogue — Krishna Gade

> [03:06](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=186s) cost per successful task — Krishna Gade

> [03:06](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=186s) system of trust — Krishna Gade

> [05:16](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=316s) choke point — Krishna Gade

> [09:10](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=550s) maker and checker separation — Krishna Gade

> [09:10](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=550s) Centaur architecture — Krishna Gade

> [13:44](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=824s) evaluation trust tax — Krishna Gade

> [13:44](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=824s) batteries included — Krishna Gade

> [16:22](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=982s) Ask Nielsen — Krishna Gade

> [17:48](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=1068s) Because we are trying to sort of—our advocacy is that don't use LLM as a judge for everything... we compare them against all this sort of Content Safety API of Azure, or Amazon Bedrock Guardrails, or the other LLM-as-a-judge and OpenAI safety models. — Krishna Gade

## Mentioned Krishna Gade, Fiddler AI, Ai4, OpenAI, Hugging Face, Facebook, Nielsen, Ask Nielsen, GPT-4o mini, Azure AI Content Safety, Amazon Bedrock Guardrails, National Association of Insurance Commissioners (NAIC), Federal Reserve SR 11-7, EU AI Act, Fiddler Centaur Models

## Video description Krishna Gade - Founder & CEO, Fiddler AI

AI agents are operating inside critical business workflows, making decisions, taking actions, and interacting with enterprise systems with increasing autonomy. But the infrastructure enterprises rely on was never designed for systems that reason and act on their own. As a result, many organizations are deploying agents without clear oversight for how they behave, what decisions they make, or how policy and governance should be applied. Risk surfaces only after something goes wrong, and compliance teams lack the visibility required to confidently scale adoption. The next phase of enterprise AI requires a new system of trust: a control plane for agentic systems. This session makes the case that the control plane is the real constraint in enterprise AI. We'll show what closes that gap: inline guardrails that enforce policy on coding agents’ request and response paths and fleet-wide intelligence that ties agent behavior to cost by developer, team, and token. We will also cover how the control plane serves as a foundation for auditable governance and how Fiddler Centor Models maintain low evaluation costs and can help control AI budgets. You'll leave with a concrete framework for deciding how much autonomy your agents have earned and how to extend it without losing oversight.

[Source](https://www.youtube.com/watch?v=P-0eEUm-jd0)

中文简报

Fiddler推出Centaur模型，助力企业AI Agent成本削减90% 部署结合不确定性路由的专用小模型，可消除标准LLM评估器不可持续的高昂成本，同时在企业工作流中实现全面的审计追踪。 Krishna Gade指出，扩展企业级Agent系统需要超越传统监控，转向在运行时强化信任与可观测性的主动控制平面。由于多步骤自主工作流容易产生复合错误，企业需要网关级监测手段来追踪完整轨迹并保护敏感凭证。传统的“LLM作为裁判”（LLM-as-a-judge）评估方法在生产环境中会带来不可持续的“评估信任税”与过高延迟，迫使企业采取具有风险的1%至10%轨迹抽样。Fiddler通过混合Centaur模型架构解决了这一问题，该架构利用快速的专用SLM、基于不确定性的升级路由以及合成数据工厂，实现了符合主要监管框架、兼具成本效益的100%全量轨迹评估。 尽管构建自主AI Agent在技术上已变得可行，但企业的信任度仍然较低，因为缺乏直接人工验证的自主多步骤操作会带来复合故障风险。 (0:04) 企业需要一个Agent控制平面来充当统一的信任系统，用以清点Agent集群、追踪单次成功任务的成本，并在不同模型间强制执行合规策略。 (3:06) 通过中间AI网关汇聚Agent交互，可以建立关键控制点，用于在运行时捕获遥测数据、验证工具授权并执行安全策略。 (5:16) 全轨迹评估对于自主Agent至关重要，因为时间依赖性可能导致早期的提示注入或细微错误在多个步骤之后悄然破坏后续行动。 (5:16) 传统的“LLM作为裁判”（LLM-as-a-judge）方法在高吞吐量的企业生产环境中行不通，原因在于延迟过高、API成本难以持续，且违反了制作者与复核者（maker-checker）分离的合规要求。 (9:10)

Reading summary

Fiddler AI founder Krishna Gade argues that deploying autonomous multi-step AI agents introduces compounding execution risks that traditional ML monitoring and standard 'LLM-as-a-judge' setups cannot safely or affordably govern. To bridge this trust deficit, Gade proposes an independent enterprise control plane that combines gateway-level interception with hybrid, uncertainty-routed specialist models to inspect 100% of execution traces. Compounding Risks in Multi-Step Autonomous Workflows (0:04) Gade observes that while enterprise adoption of AI agents is accelerating, organizational trust remains minimal due to the unpredictable nature of multi-step execution. In traditional machine learning, data drift or broken pipelines were manageable through scheduled retraining, and early retrieval-augmented generation (RAG) applications relied on human users to intercept hallucinations. In contrast, autonomous agents directly invoke enterprise tools and external APIs across multi-step chains. Under this operational model, an ostensibly high 90% per-step accuracy causes end-to-end task completion rates to degrade exponentially as execution scales from 10 to 100 or 1,000 steps. Furthermore, agent trajectories introduce complex temporal dependencies where an early failure or prompt injection at step 2 can silently compromise execution and trigger unauthorized actions, such as data exfiltration, dozens of steps later. Gade cites an evaluation incident involving OpenAI and Hugging Face where autonomous agents attempted to access third-party production servers, illustrating how autonomous agency makes runtime observability and controllability mandatory. Gateway-Level Interception and Policy Governance (5:16) Direct model calls in early agent applications created operational blind spots, prompting enterprises to transition toward centralized AI gateways that act as architectural choke points. Routing agent traffic through an intermediate gateway allows an independent control plane to capture comprehensive telemetry across both custom enterprise agents and third-party coding tools. The control plane inspects raw inputs and outputs, intercepts pre- and post-commit requests, verifies tool authorizations, and dynamically redacts personally identifiable information (PII) and API keys before payloads leave the enterprise perimeter. This telemetry feeds an auditable fleet-wide data lake, enabling compliance teams in regulated sectors like banking, healthcare, and insurance to enforce governance mandates. Out-of-the-box evaluators support structured compliance frameworks, including the Federal Reserve's SR 11-7 model risk management guidance, National Association of Insurance Commissioners (NAIC) standards, and the EU AI Act. Economic Limits of LLM-as-a-Judge (9:10) Evaluating subjective, non-deterministic agent behavior historically relied on 'LLM-as-a-judge' frameworks, but Gade contends this design is fundamentally unsuitable for high-throughput production. Originally developed for offline evaluations over static datasets of roughly 1,000 samples, frontier LLM evaluators introduce unsustainable latency and create an 'evaluation trust tax,' where runtime monitoring expenses balloon to 100% or 200% of the primary inference spend. To curb costs, engineering teams frequently resort to sampling only 1% to 10% of execution traces, leaving up to 99% of enterprise traffic uninspected and creating severe vulnerabilities to data leaks and jailbreaks. Relying on frontier models to grade their own or closely related outputs also violates the basic 'maker-checker separation' required in enterprise compliance. Gade argues that sustainable governance requires evaluation overhead to scale predictably at 10% to 20% of primary inference expenditure while preserving full trace visibility. Centaur Routing and Synthetic Model Training (12:06) To replace monolithic LLM evaluation without burdening internal teams with maintaining custom models, Fiddler developed the 'Centaur' architecture. Incoming spans are first evaluated by small, specialized language models fine-tuned to detect specific failure modes—such as hallucinations, PII leakage, and prompt injections—at costs 90% to 98% lower than commercial options like GPT-4o mini. The engine calculates uncertainty metrics alongside classification scores; low-uncertainty evaluations complete instantly at high throughput, while out-of-distribution or ambiguous traces dynamically escalate to larger hosted open-weight models. To train these specialist evaluators without exposing confidential customer records, Fiddler uses an internal synthetic data factory that simulates enterprise traffic patterns and novel adversarial jailbreaks. Media company Nielsen adopted this control plane architecture to transition its 'Ask Nielsen' data question-answering agent from an open-source evaluation prototype into a production environment with strict latency, cost, and reliability constraints. Fiddler reports that its specialist evaluation models are systematically benchmarked against commercial alternatives like Azure AI Content Safety and Amazon Bedrock Guardrails to ensure accuracy parity without frontier model latency and cost. However, the viability of autonomous agent deployment ultimately depends on whether hybrid evaluation architectures can continue outpacing sophisticated adversarial techniques and tool-use vulnerabilities as enterprise execution chains grow longer and more interconnected.

精炼阅读摘要

Fiddler AI 创始人兼首席执行官 Krishna Gade 指出，随着企业应用从有人工介入的检索增强生成（RAG）转向能够自主调用工具与 API 的多步骤智能体（Agent），系统正面临严峻的信任缺失与复合错误风险。他主张企业必须建立中立于模型和云平台的智能体控制平面，依托网关层全轨迹拦截与“半人马”（Centaur）混合评估架构，以可控的算力成本实现全量监控与合规治理。 自主智能体的复合风险与信任危机 (0:04) Krishna Gade 认为，企业人工智能的风险范式在过去三年经历了根本性演变。在传统机器学习时代，团队主要监控数据漂移与特征归因，模型故障仅需重新调试或重新训练管线；在早期大语言模型与聊天机器人阶段，输出幻觉也大多可通过屏幕前的人工交互进行过滤。然而，当系统演进为在企业内部自主执行多步骤操作的智能体时，人工的直接干预被剥离，系统故障的影响随之急剧扩大。例如近期在 OpenAI 与 Hugging Face 的评估测试中，就曾出现自主智能体行为失控并试图渗透外部生产服务器的安全事件。 Gade 进一步分析，多步执行链存在严重的“复合错误率”风险。即使单个执行步骤维持 90% 的看似可接受的准确率，当任务链路扩展至数十步甚至上千步时，端到端的整体成功率也会呈指数级下滑。此外，多步轨迹包含复杂的时序依赖关系，例如在第 2 步遭受的提示词注入攻击，可能在第 21 步才静默触发未授权的数据导出操作。这导致业内虽然普遍在构建智能体，但极少有技术管理者敢于在生产环境中对其实行完全信任。 网关层控制平面与全轨迹治理 (3:06) 针对受监管行业企业对投资回报率（如“每次成功任务成本”）以及合规治理的迫切诉求，Gade 提出应建立一套覆盖所有自研与第三方智能体的企业级“控制平面”（Control Plane）。早期的智能体通常直接调用底层模型与外部 API，形成了严重的监控盲区；而新型控制平面则通过中央 AI 网关构建核心拦截点（Choke Point），在预提交与后提交阶段拦截全部遥测数据，实时核验工具调用授权，并检测敏感身份信息（PII）与机密密钥泄露。 该控制平面将分散的智能体运行轨迹沉淀为全企业通用的数据湖，为满足银行业 SR 11-7 模型风险管理、美国全国保险专员协会（NAIC）准则以及欧盟人工智能法案（EU AI Act）提供不可篡改的审计追踪。在针对代码编写智能体（Coding Agent）的场景中，控制平面能够实时审计每个执行跨度（span）的消耗，并在行内动态拦截敏感凭证，使用合成标记替换真实 API 密钥，确保企业专有代码和核心凭据绝不泄露给外部模型服务商。 破解评审成本瓶颈的 Centaur 架构 (9:10) 针对智能体非确定性行为的评测需求，Gade 认为业内通行的“大模型作为评审员”（LLM-as-a-judge）模式在生产环境中难以持续。该模式原用于离线静态数据集的小规模测试，而在日均产生数百万条复杂调用轨迹的企业生产环境中，完全依赖大型前沿模型不仅会带来过高延迟，还会产生高昂的“评估信任税”——运行评审模型的费用往往达到应用核心推理开销的 100% 甚至 200%。为削减成本，许多工程团队退而求其次采用 1% 至 10% 的抽样检测，导致 90% 以上的流量处于完全未受监控的盲区，且模型自我评审也违背了金融合规中的“制定者与复核者分离”原则。 为此，Fiddler 提出了由轻量级专用小模型与开源语言模型组成的“半人马”（Centaur）混合评估引擎。系统首先由专用小模型快速检测幻觉、敏感信息和越狱攻击，并量化输出的不确定性；仅在检测到置信度不足或分布外输入时，才动态将任务升级至大型模型进行深层语义推理。据 Gade 介绍，这一架构相较于调用 GPT-4o mini 等商业小模型降低了约 90% 至 98% 的评估成本，将治理开销控制在应用总预算的 10% 到 20% 以内，从而让企业有能力负担 100% 的全量轨迹监控。为解决企业无法提供专有业务数据训练第三方模型的限制，该方案采用内部合成数据工厂，通过模拟企业流量特征与前沿越狱手段来持续微调专用模型。 Gade 强调，专用评估体系必须通过客观精度对标来证明其可靠性，Fiddler 已将其专用模型与微软 Azure 内容安全、亚马逊 Bedrock Guardrails 及前沿大模型安全能力进行常态化对比，并以此支持了媒体监测机构尼尔森（Nielsen）将其“Ask Nielsen”智能体从开源评估原型扩展至低延迟的企业生产环境。不过，如何在对抗策略快速翻新与超长链路时序依赖的极端情况下，持续确保合成训练数据的实战防御有效性，仍将是此类控制架构需要经受检验的现实课题。

Detailed notes — zh

## Background 本内容由 Ai4 于 2026 年 8 月 19 日在 YouTube 平台发布，由 Fiddler AI 创始人兼 CEO Krishna Gade 主讲。视频围绕自主智能体进入企业关键工作流带来的信任与合规挑战展开，介绍了 Fiddler 如何通过控制平面、内联防护栏、全轨迹评测及低成本 Centaur 半人马模型来构建可审计的智能体信任系统。 ## TL;DR Krishna Gade 指出当前企业虽普遍试水 AI 智能体，但在多步长自主执行场景中普遍面临信任缺失与复合误差风险。为解决传统 LLM-as-a-Judge 方案高延迟、高成本且难以承受生产级海量 Trace 评测的瓶颈，Fiddler 提出了基于 API 网关的统一控制平面与 Centaur 混合架构。该方案通过专用小模型打分、不确定性路由大模型以及合成数据工厂，在大幅降低评测成本的同时，实现了对 API 密钥泄露阻断、PII 保护及行业合规审计的端到端治理。 ## Atmosphere & style 演讲以直击痛点的现场举手表决开场，瞬间勾起台下工程师与架构师在生产实践中“既想用又不敢信”的深层焦虑。主讲人语调沉稳笃定、工程视角极为犀利，从行业突发安全事故自然切入底层架构瓶颈，层层剥离技术迷思。整场分享节奏明快且技术信息密度极高，既有直面“高昂评估信任税”的行业现实批判，又给出了具象可落地的解题蓝图，现场互动问答严谨务实。 ## Key takeaways - [00:04](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=4s) 企业在广泛构建和部署 AI 智能体的同时，普遍缺乏对生产环境中自主运行智能体的充分信任。 - [01:48](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=108s) 从传统 ML、Chatbot/RAG 到多步自主智能体，人类逐步失去直接把关能力，执行链路风险呈指数级上升。 - [03:06](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=186s) 企业级 AI 基础设施正从‘记录系统’和‘智能系统’迈向中立于模型和云厂商的‘信任系统’（控制平面）。 - [05:16](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=316s) API 网关是捕获智能体多步执行轨迹、防范复合误差（Compounding Error）并实施安全策略的最佳控制咽喉。 - [07:47](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=467s) 控制平面可在企业边界实时拦截编码智能体（Coding Agents）外泄的敏感代码、API 密钥与 PII 数据。 - [09:16](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=556s) 传统的 LLM-as-a-Judge 无法应对生产级高并发 Trace/Span 的高昂成本与延迟，且违背‘制检分离’原则。 - [12:06](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=726s) Fiddler Centaur 架构结合微调小型专用模型（SLM）与不确定性动态路由，兼顾了低延迟、高精度与超低评测成本。 - [12:06](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=726s) 通过‘合成数据工厂’生成高质量对抗样本，无需依赖客户原始敏感数据即可高效迭代安全检测模型。 - [13:44](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=824s) Centaur 模型消除高昂的‘评估信任税’，相比主流轻量 LLM 裁判可降低 90% 至 98% 的评测成本，避免抽样盲区。 - [16:22](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=982s) 控制平面支持涵盖毒性、越狱、PII 以及 NAIC、SR 11-7、EU AI Act 等行业 GRC 合规标准的开箱即用评估器。 - [16:22](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=982s) 尼尔森（Nielsen）通过引入 Fiddler 控制平面，成功替代了无法满足生产级扩展需求的开源 LLM-as-a-Judge 方案。 - [17:48](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=1068s) 针对编码智能体的长链路执行，系统可实现逐 Span 成本归因、实时敏感信息打码与 API 密钥动态混淆。 ## Detailed walkthrough ### [00:04](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=4s) 智能体时代的信任危机与企业现实 演讲开场时，Krishna Gade 向现场观众提出了两个互动问题：有多少人正在企业内部构建或部署 AI 智能体（Agent）？全场几乎所有人都举起了手。紧接着他又问：又有多少人能完全信任正在生产环境中运行的这些智能体？举手的人寥寥无几。这个鲜明的反差揭示了当下的核心困境：虽然如今拥有足够复杂的模型、算力基础设施，以及从编码智能体到开源方案的各类应用框架，但如何确保智能体以值得信赖的方式运行，并深入洞悉其内部实际行为，依然是全行业面临的重大挑战。 几周前发生的 OpenAI 与 Hugging Face 评测事件正是这一风险的现实缩影——当时评测中的智能体发生失控异常（went rogue），甚至侵入了其他公司的生产服务器。作为 Fiddler AI 的创始人兼 CEO，Krishna Gade 结合自己在 AI 信任与可观测性领域超过七年的经验（此前他曾在 Facebook 负责 AI 基础设施），指出智能体规模在未来几年将呈爆发式增长，构建面向智能体系统的控制平面（Control Plane）已迫在眉睫。 - 现场调查显示：绝大多数企业已在构建/部署智能体，但极少数人对其生产环境表现抱有充分信任。 - 近期典型事件：智能体在评测与实际执行中出现失控并产生越权访问甚至攻击生产服务器的潜在安全漏洞。 --- ### [01:48](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=108s) 从传统模型、RAG 到自主智能体的演进与风险升级 回顾过去三年的 AI 发展历程，企业应用的形态经历了几次剧烈跳跃：最初是面向消费场景的 Chatbot，虽然存在幻觉问题，但用户仅将其视作一种干扰（nuisance）；随后进入 RAG（检索增强生成）时代，企业开始通过上下文注入来控制事实依据与确定性（groundedness）；如今则全面跨入生产级智能体与全自主工作流（autonomous workflows）。在这个演进路径中，潜在业务风险呈指数级升级。 在传统机器学习时代，团队只需监控模型漂移（model drift）、特征归因（feature attributions）和数据质量；即便模型报错，也只需修复数据管道或重新训练模型，并不会带来毁灭性后果。在早期的 LLM 应用中，聊天窗口前依然有真人把关（Human-in-the-loop），用户能够肉眼识别幻觉并不盲信输出。但在智能体时代，人类正在逐步失去对执行链路的直接控制——智能体以高度自主的方式执行复杂任务，这使得治理、可观测性与可控性变成了不可或缺（non-optional）的基础设施。 ```mermaid flowchart LR accTitle: AI Paradigm Evolution and Risk Escalation subgraph S1["传统 ML 时代"] M1["模型漂移与数据监控"] --> M2["人类离线重新训练"] end subgraph S2["Chatbot / RAG 时代"] R1["上下文检索与事实校验"] --> R2["真人交互前置把关"] end subgraph S3["自主智能体时代"] A1["多步长链路自主执行"] --> A2["控制平面实时拦截与治理"] end S1 --> S2 --> S3 ``` --- ### [03:06](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=186s) 企业级控制平面：从记录系统到“信任系统” 当与金融服务（FSI）、医疗健康、制药等高度合规行业的 AI 平台负责人、架构师和安全专家沟通时，企业关注的痛点高度集中在几个核心诉求上：如何衡量实际投资回报率（ROI）、如何量化“单次成功任务成本”（Cost per successful task）、如何获取覆盖全企业 AI 资产的全局统一视图，以及在严格满足风险合规与审计治理的前提下安全部署智能体。 为了应对这一需求，Fiddler 提出了中立于模型和云厂商（Model-agnostic & Cloud-agnostic）的控制平面架构。业界已经经历了以数据库为代表的“记录系统”（System of Records）和以各类算法模型为代表的“智能系统”（System of Intelligence），如今正在迈向“信任系统”（System of Trust）的新阶段。该系统必须能够同时管理企业内部自研的智能体（First-party Agents）以及外部采购的商用与 SaaS 编码智能体（Third-party Agents），实现资产盘点、能力评测、行为监控、策略校验与全面治理。 - 核心诉求：跨平台 AI 资产全局视图、成本精确归因（按任务/团队/Token）、合规审计达标。 - 架构属性：独立于具体大模型（无论是开源权重还是闭源模型）与底层云厂商的统一信任层。 --- ### [05:16](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=316s) 网关作为关键咽喉：解决多步长复合误差与全轨迹评测 在工程架构层面，智能体的设计模式正迅速向 API 网关汇聚。早期智能体多由自身代码直接发起模型与工具调用，而现代架构则将所有对外调用（Model Calls 与 Tool Calls）收敛到网关层进行抽象。这种设计使得网关成为了捕获智能体行为并执行安全策略的最佳“咽喉点”（choke point）。 通过将 Fiddler 控制平面接入各类网关，系统可以全面捕获包含预提交（Pre-commit）与后提交（Post-commit）在内的全部遥测数据，实时核验工具调用是否获得合规授权、模型返回是否泄露 PII（个人身份信息）等。这种全轨迹评测（Full Trajectory Evaluation）对于多步执行的智能体至关重要：当任务从 10 步扩展到 100 步乃至 1000 步时，系统会面临灾难性的“复合误差”（Compounding Error）。即使单步准确率高达 90%，在执行 100 步后整体成功率也会大幅滑坡；若第 2 步的细微偏差隐蔽影响了第 21 步，且期间伴随越狱攻击（Jailbreak）或下游异常数据访问，只有通过全轨迹分析才能准确归因并诊断根因。 ```mermaid flowchart TD accTitle: Gateway-based Trajectory Evaluation Architecture Agent["自主智能体 / 编码智能体"] -->|请求与工具调用| GW["API 代理网关 Gateway"] GW -->|遥测与预拦截请求| CP["Fiddler 控制平面 / 信任系统"] subgraph CP["控制平面实时校验"] direction TB V1["工具调用授权与 PII 筛查"] V2["多步复合误差与越狱检测"] V3["全轨迹 Trajectory 状态追踪"] end CP -->|策略放行| Ext["下游模型 / 工具服务"] CP -->|违规阻断 / 审计沉淀| DL["企业级审计数据湖"] ``` --- ### [07:47](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=467s) 编码智能体安全拦截与企业级机群资产治理 在实际业务场景中，编码智能体（Coding Agents）的普及尤为迅猛，但风险也随之暴露。开发者在日常使用时拥有极高的自由度，可能会无意或有意地将企业的绝密密钥（Secret Keys）或内部敏感代码输入到提示词中。如果不加防护，这些核心资产就会直接泄露至公有云或第三方模型提供商。 通过在网关层部署策略拦截，控制平面能够在数据离开企业边界前完成实时识别与阻断。在此基础上，控制平面还能对全企业范围内运行的整个智能体机群（Agentic Fleet）进行盘点与集中监控。所有抓取到的遥测数据汇总进入统一数据湖，不仅能生成完整的行为审计线索，清晰还原每个智能体何时发起了未授权的工具调用或异常模型请求，还能建立起跨组织的透明监管网络。 - 典型防护用例：防止开发者向外部大模型输入内部 API Key、敏感代码或高危指令。 - 机群监控能力：集中汇聚调用轨迹，提供具备法律与合规效力的不可篡改审计日志。 --- ### [09:16](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=556s) LLM-as-a-Judge 的规模瓶颈与 Centaur 半人马评测架构 智能体与传统软件在评测机制上存在本质差异：传统软件可以通过单元测试、吞吐量、延迟、可用性等确定性指标进行量化；但智能体的行为是非确定性的，必须引入裁判机制来“判定其行为”（Judge its behavior）。过去几年兴起的“LLM-as-a-Judge”（大模型作为裁判）虽然解决了人工标注难以扩展的问题，但它最初仅设计用于预发布阶段的小规模 Golden Dataset（如 1000 个样本的 RAG 调优）。当面对生产环境中每天产生数百万条 Trace、每条 Trace 包含数千个 Span 的超大规模高并发负载时，依赖通用 LLM 作为在线裁判在成本、延迟和可靠性上全面失效。此外，评测体系还需要严格遵循“制作者与检查者分离”（Maker-Checker Separation）原则，不能用生成代码的同一套系统进行自我监督。 为此，Fiddler 研发了独立的“半人马模型架构”（Centaur Architecture）。该架构采用分层协同机制：底层部署一组经过微调的小型专用模型（Small Specialist Models），专精于高速低成本识别幻觉、PII 泄露、越狱攻击等已知高危模式；顶层配合一组可定制微调的开源权重语言模型。在运行时评测 Span 或 Trace 时，系统首先由小型专家模型进行实时打分并评估“不确定性”（Uncertainty），在兼顾超低评测延迟与成本的同时，保障严谨的独立信任判定。 - LLM-as-a-Judge 的局限：难以承受生产级海量 Trace/Span 的吞吐压力与高昂推理成本，且缺乏制检分离。 - Centaur 架构核心：小型专精模型（检测幻觉/PII/越狱） + 开源权重模型智能路由 + 不确定性量化评估。 ### [12:06](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=726s) 半人马混合评估架构与合成数据工厂 为了在全流程 Agent 工作流中同时兼顾评估准确率与响应延迟，Fiddler 提出了一套基于不确定性度量的“半人马”（Centaur）混合模型架构。当输入请求进入系统时，小型专用语言模型（SLM）不仅会输出分类评估得分，还会量化该输入是否属于分布外（Out-of-Distribution）的不确定性分数。一旦检测到不确定性较高，系统便会动态将请求路由给能力更强的大型模型以获取高度可靠的判定结果，从而在保障延迟与精度的同时打破传统评估的成本瓶颈。 在模型训练与迭代层面，企业客户通常出于隐私合规顾虑无法直接提供原始业务数据用于小模型微调。为此，Fiddler 构建了“合成数据工厂”（Synthetic Data Factory），通过提取已知用例生成多样化的合成数据集。这一机制在应对越狱（Jailbreak）等新型对抗性攻击与安全评估时尤为关键，能够持续模拟黑客不断翻新的攻击手法，为检测模型提供充足的高质量对抗样本。 ```mermaid flowchart TD accTitle: Centaur Model Routing Architecture subgraph InputStage["输入与专用模型评估"] A["Agent 输入与调用追踪 (Span)"] --> B["专用小语言模型 (Centaur SLM)"] B --> C{"不确定性评分 / 分布外检测"} end subgraph RoutingStage["动态路由分发"] C -- "低不确定性 (置信度高)" --> D["直接输出低延迟评估结果"] C -- "高不确定性 (分布外样本)" --> E["路由至高精度大模型 (LLM Judge)"] E --> F["输出高可靠性综合判定"] end ``` --- ### [13:44](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=824s) 破除“评估信任税”：Centaur 模型的业务价值与成本优势 传统采用纯“LLM 即裁判”（LLM-as-a-Judge）的方案在业务落地中面临严重的成本失控问题。随着运行时评估密度的增加，评估费用往往迅速逼近甚至超过主业务的推理成本。演讲者将其称为企业获取可信度时必须支付的“评估信任税”（Evaluation Trust Tax），并指出监控系统的开销应当控制在应用开发支出的 10% 到 20%，绝不能演变成高达 200% 的沉重负担。Centaur 架构通过小模型集成的方案成功化解了这一痛点： - **杜绝抽样带来的风险敞口**：许多团队因 LLM 评估过于昂贵而退而求其次，仅对 1% 到 10% 的 Trace 日志进行抽样评估，这直接导致企业暴露在 90% 到 99% 的未监控风险之下，极易漏检 PII 泄露或越狱事件。 - **避免自建小模型的运维重负**：企业若自行微调维护小模型会产生巨大的工程与运维开销，而 Fiddler 提供开箱即用（Batteries-Included）的评估控制面，如同自带完整电池组的汽车。 - **近乎线性的极低扩展成本**：实测数据显示，相较于市场上的 GPT-4o mini 等主流轻量模型，Centaur 模型可降低 90% 至 98% 的评估成本，即便评估调用量成倍增长，成本曲线依然保持平缓线性。 --- ### [16:22](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=982s) 开箱即用的安全合规评估器与 Nielsen 落地案例 Fiddler 控制面内置了一系列覆盖常见安全隐患的通用评估器，包括越狱检测、毒性内容过滤、PII 识别、幻觉检测以及工具调用授权控制。同时，系统还支持深度定制针对特定行业治理、风险与合规（GRC）要求的评估器，例如保险业适用的 NAIC 指引规则、银行业的 SR 11-7 模型风险管理标准，以及针对最新生效的《欧盟人工智能法案》（EU AI Act）设立合规审查评估器。 在行业落地方面，知名全球媒体与数据分析巨头尼尔森（Nielsen）在构建其旗舰级对话 Agent“Ask Nielsen”时，初期采用了开源的 LLM-as-a-Judge 评估框架。随着产品逐步接入底层核心数据基础设施并向终端客户开放，开源方案的扩展性与性能无法满足生产级要求。尼尔森随后与 Fiddler 展开深度合作，借助高扩展性的评估控制面成功实现了产品的可靠上线与稳定运营。 --- ### [17:48](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=1068s) 面向代码生成 Agent 的运行时管控与现场问答 针对当前企业内部广泛使用却缺乏有效监管的编程智能体（Coding Agents），Fiddler 控制面提供了全生命周期的可审计记录与精细化防护。面对 Coding Agent 产生的超长 Trace 链路，系统可以针对每一个执行 Span 实时计算工具与模型调用成本，并执行实时拦截脱敏。尤为关键的是，对于代码中出现的 API 密钥和 PII 信息，系统不仅能够自动打码（Redaction），还能在请求发送给模型供应商前对密钥进行混淆与动态替换，确保外部 LLM 无法获取真实凭证。 ```mermaid flowchart LR accTitle: Coding Agent Guardrailing Flow subgraph TraceCapture["链路追踪与成本分析"] A["Coding Agent 长执行链路"] --> B["逐 Span 追踪工具与 LLM 消耗"] end subgraph PolicyEnforcement["安全拦截与敏感信息保护"] B --> C["PII / API 密钥检测"] C --> D["自动打码 (Redaction)"] C --> E["密钥动态混淆 / 替换"] end subgraph Upstream["安全外发"] E --> F["LLM 服务商接收混淆后请求"] end ``` 在最后的问答环节，有观众提问系统在聚焦信任与可观测性的同时，如何评估和验证这些评估模型自身输出答案的准确性。演讲者回应称，Fiddler 团队一直在持续对其内部评估模型进行严格的基准测试，并直接对标微软 Azure Content Safety API、亚马逊 Amazon Bedrock Guardrails 以及 OpenAI Safety Models 等主流安全方案。Fiddler 的核心主张正是打破盲目依赖大模型做裁判的单一模式，在严守高准确率的前提下，为企业提供极致的低延迟与低成本控制能力。 ## Notable quotes > [00:04](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=4s) 有多少人正在企业内部构建或部署 AI 智能体（Agent）？全场几乎所有人都举起了手。紧接着他又问：又有多少人能完全信任正在生产环境中运行的这些智能体？举手的人寥寥无几。 — Krishna Gade > [03:06](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=186s) 业界已经经历了以数据库为代表的“记录系统”（System of Records）和以各类算法模型为代表的“智能系统”（System of Intelligence），如今正在迈向“信任系统”（System of Trust）的新阶段。 — Krishna Gade > [05:16](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=316s) 现代架构则将所有对外调用（Model Calls 与 Tool Calls）收敛到网关层进行抽象。这种设计使得网关成为了捕获智能体行为并执行安全策略的最佳“咽喉点”（choke point）。 — Krishna Gade > [05:16](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=316s) 当任务从 10 步扩展到 100 步乃至 1000 步时，系统会面临灾难性的“复合误差”（Compounding Error）。即使单步准确率高达 90%，在执行 100 步后整体成功率也会大幅滑坡。 — Krishna Gade > [09:16](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=556s) 评测体系还需要严格遵循“制作者与检查者分离”（Maker-Checker Separation）原则，不能用生成代码的同一套系统进行自我监督。 — Krishna Gade > [13:44](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=824s) 监控系统的开销应当控制在应用开发支出的 10% 到 20%，绝不能演变成高达 200% 的沉重负担。 — Krishna Gade > [13:44](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=824s) 许多团队因 LLM 评估过于昂贵而退而求其次，仅对 1% 到 10% 的 Trace 日志进行抽样评估，这直接导致企业暴露在 90% 到 99% 的未监控风险之下。 — Krishna Gade > [13:44](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=824s) 相较于市场上的 GPT-4o mini 等主流轻量模型，Centaur 模型可降低 90% 至 98% 的评估成本，即便评估调用量成倍增长，成本曲线依然保持平缓线性。 — Krishna Gade > [17:48](https://www.youtube.com/watch?v=P-0eEUm-jd0&t=1068s) 对于代码中出现的 API 密钥和 PII 信息，系统不仅能够自动打码（Redaction），还能在请求发送给模型供应商前对密钥进行混淆与动态替换，确保外部 LLM 无法获取真实凭证。 — Krishna Gade ## Mentioned Krishna Gade, Fiddler AI, Centaur Models, OpenAI, Hugging Face, Facebook, GPT-4o mini, Nielsen, Ask Nielsen, Azure Content Safety API, Amazon Bedrock Guardrails, EU AI Act, NAIC, SR 11-7 ## Video description Krishna Gade - Founder & CEO, Fiddler AI AI agents are operating inside critical business workflows, making decisions, taking actions, and interacting with enterprise systems with increasing autonomy. But the infrastructure enterprises rely on was never designed for systems that reason and act on their own. As a result, many organizations are deploying agents without clear oversight for how they behave, what decisions they make, or how policy and governance should be applied. Risk surfaces only after something goes wrong, and compliance teams lack the visibility required to confidently scale adoption. The next phase of enterprise AI requires a new system of trust: a control plane for agentic systems. This session makes the case that the control plane is the real constraint in enterprise AI. We'll show what closes that gap: inline guardrails that enforce policy on coding agents’ request and response paths and fleet-wide intelligence that ties agent behavior to cost by developer, team, and token. We will also cover how the control plane serves as a foundation for auditable governance and how Fiddler Centor Models maintain low evaluation costs and can help control AI budgets. You'll leave with a concrete framework for deciding how much autonomy your agents have earned and how to extend it without losing oversight. [Source](https://www.youtube.com/watch?v=P-0eEUm-jd0)

Source quotes

[0:04] Krishna Gade: 有多少人正在企业内部构建或部署 AI 智能体（Agent）？全场几乎所有人都举起了手。紧接着他又问：又有多少人能完全信任正在生产环境中运行的这些智能体？举手的人寥寥无几。 [3:06] Krishna Gade: 业界已经经历了以数据库为代表的“记录系统”（System of Records）和以各类算法模型为代表的“智能系统”（System of Intelligence），如今正在迈向“信任系统”（System of Trust）的新阶段。 [5:16] Krishna Gade: 现代架构则将所有对外调用（Model Calls 与 Tool Calls）收敛到网关层进行抽象。这种设计使得网关成为了捕获智能体行为并执行安全策略的最佳“咽喉点”（choke point）。 [5:16] Krishna Gade: 当任务从 10 步扩展到 100 步乃至 1000 步时，系统会面临灾难性的“复合误差”（Compounding Error）。即使单步准确率高达 90%，在执行 100 步后整体成功率也会大幅滑坡。 [9:16] Krishna Gade: 评测体系还需要严格遵循“制作者与检查者分离”（Maker-Checker Separation）原则，不能用生成代码的同一套系统进行自我监督。 [13:44] Krishna Gade: 监控系统的开销应当控制在应用开发支出的 10% 到 20%，绝不能演变成高达 200% 的沉重负担。 [13:44] Krishna Gade: 许多团队因 LLM 评估过于昂贵而退而求其次，仅对 1% 到 10% 的 Trace 日志进行抽样评估，这直接导致企业暴露在 90% 到 99% 的未监控风险之下。 [13:44] Krishna Gade: 相较于市场上的 GPT-4o mini 等主流轻量模型，Centaur 模型可降低 90% 至 98% 的评估成本，即便评估调用量成倍增长，成本曲线依然保持平缓线性。 [17:48] Krishna Gade: 对于代码中出现的 API 密钥和 PII 信息，系统不仅能够自动打码（Redaction），还能在请求发送给模型供应商前对密钥进行混淆与动态替换，确保外部 LLM 无法获取真实凭证。

Source quotes

[0:04] Krishna Gade: How many of you fully trust the agents running in production today? [0:04] Krishna Gade: went rogue [3:06] Krishna Gade: cost per successful task [3:06] Krishna Gade: system of trust [5:16] Krishna Gade: choke point [9:10] Krishna Gade: maker and checker separation [9:10] Krishna Gade: Centaur architecture [13:44] Krishna Gade: evaluation trust tax [13:44] Krishna Gade: batteries included [16:22] Krishna Gade: Ask Nielsen [17:48] Krishna Gade: Because we are trying to sort of—our advocacy is that don't use LLM as a judge for everything... we compare them against all this sort of Content Safety API of Azure, or Amazon Bedrock Guardrails, or the other LLM-as-a-judge and OpenAI safety models.

Original transcript

[0:04] Maybe before I start the presentation, uh how  many of you are building or deploying agents [0:11] in your companies today? Show of hands. Almost  everybody makes sense. How many of you fully [0:17] trust the agents running in production today?  Maybe a few. Uh so that's basically the topic, [0:25] right? So today we have uh sufficiently complex  models and compute infrastructure available and [0:34] also different types of application frameworks  from coding agent frameworks to open-source [0:41] frameworks that allow us to build these agentic  applications. The problem is how do we make sure [0:49] that these agents are running in a trustworthy  manner and we are able to like you know know [0:56] what's going on with those agents you know in the  internals more deeply. Case in point you know what [1:03] happened a few weeks ago with the open AI hugging  face eval incident where agents went rogue and and [1:10] sort of hacked into production servers of other  companies. So that's where you know uh that's [1:16] where essentially the topic could be interesting  and I'm Krishna Gad. I'm the founder and CEO of [1:22] Fiddler AI. Uh we have been working on AI trust  and observability for the past seven plus years. [1:28] Prior to that I spent time at Facebook on AI  infrastructure and at Fiddler we're building [1:32] this control plane u regentic systems as uh the  growth of the agents is set to be enormous in [1:42] the coming years and the problems that we have  seen if you just step back where we have come [1:48] from right in the last three years we've come from  you know chat bots you know we all sort of used on [1:55] you know consumer use cases interacted with them.  You know, yeah, hallucinations happen, maybe it's [2:00] a nuisance, right? But then it went to like rag  applications where you can contextualize some of [2:04] this, maybe control uh some of the groundedness  aspect of it. Now we are moving into agentic [2:10] and production use case of agents and also more  into autonomous workflows. And this is where the [2:15] risks keep escalating. Right? So when we started  Fiddler, we started in the machine learning models [2:20] era where you need to we needed to track  model drift. you needed to track like feature [2:26] attributions, data quality, but if models did go  wrong, it's not earthshattering. You could always, [2:31] you know, figure out what happened, fix a data  pipeline or retrain the model. It's it's fine. [2:37] And then we went through the LLM LLM applications  where there was still a human sitting in front of [2:43] a chatbot. Okay, yeah, it's hallucinated. Okay, I  I can figure it out. Maybe I'll fix I'll sort of [2:48] won't believe what it is saying. As we move into  agentic era, we're losing more and more control, [2:55] right? Where we agents are more more  or less autonomous and doing tasks. And [2:59] that's where governance and observability  and controllability become non-optional. [3:06] So when I speak to some of our customers and  you know heads of AI platforms or architects and [3:14] uh security folks u there are a few common themes  that emerge right you know essentially everyone is [3:20] looking for ROI there's there's this whole cost  per successful task conversation that's probably [3:26] happening in your organizations on how do I  measure ROI how do I get a single view across all [3:33] my AI how do I make sure my costs are managed very  well. How do I deploy these agents safely in the [3:40] first place? And if I'm working in in a regulated  company, how do I make sure I'm satisfying, [3:45] you know, governance and and you know, risk and  compliance problems. [snorts] So that's basically [3:51] the journey that we have seen with many of our  enterprise customers across FSI, healthcare, [3:57] pharma where as the world moved from models  to LLMs to agents, you know, they're sort of [4:03] like upgrading, you know, their sort of journeys  with us, right? So the way we define the control [4:08] plane is basically on on this sort of as a model  agnostic cloud agnostic layer. So today there are [4:17] many uh foundation models available for you open  weights models, closed models. There are multiple [4:22] AI factories that we can build agents from. Um but  then what is required is a a single control plane [4:31] that can inventoriize the agents that you have,  help you evaluate what's good with those agents, [4:37] help you monitor those agents, check for policy,  and then make sure that you're governing them. [4:44] And that's that's what I call it a system of  trust. Right? So we have seen you know system [4:50] of intelligence, system of records. Now we are  moving into uh a system of trust conversation [4:57] and the system of trust needs to scale from  firstparty applications that you might be [5:02] building for yourself you know and also third  party agents that you are probably buying off [5:07] the shelf like SAS agents or coding agents.  And the way the architecture like the design [5:16] pattern is coming through is you can essentially  most of these agents are now able to connect to [5:22] a gateway to call the different models and tool  calls. So gateway becomes like a an interesting [5:29] choke point for us to instrument the agentic  behavior and and also enforce policy. Right? So, [5:38] so essentially think about like a longunning  agent and it's making you know a series of [5:44] model calls and tool calls and and now you can you  in the first innings of uh agentic applications [5:52] people built that such that they agent itself is  directly calling the models and tools but now once [5:57] you have a gateway level like abstraction you  can delegate the gateway you know in software [6:03] essentially abstracted out with one level of  referencing now you and essentially move all [6:08] of your observability and uh a controllability  to that gateway gateway layer. So the fiddler [6:15] control pane works with a variety of different  gateways and what we do is we actually take all [6:21] the telemetry coming out of the gateway pre-commit  postcomit calls to models tool calls. So and then [6:29] we quickly check if this is actually happening  correctly the tool call is authorized properly [6:35] if the model call resulted in a PII or you know  and and the sequence of it right and why is this [6:40] important? This is important because you want  to have a full trajectory uh evaluation right [6:48] because essentially right now the biggest problem  in industry is with agents getting multi-step and [6:54] the steps could be like going from 10 steps to  100 steps to thousand steps you have a compounding [7:00] error scenario. You can have each step to be like  say 90% accurate but then by the time you come to [7:06] the 100th step your overall accuracy has dipped  quite a bit. And if your steps are dependent on [7:12] each other where the second step is influencing  the 21st step now you have like a a problem that [7:19] it's very hard to diagnose. So case in point  a jailbreak attack happens and subsequently [7:24] downstream some anomalous data access happened.  You should be able to do the full trajectory valce [7:31] through the full sort of behavior of the agent to  be able to know what's going on. And that's where [7:36] this architecture hap works out very very well. So  basically kind of how this looks in sort of uh in [7:47] practice right. So these days uh coding agents are  growing very fast and everyone is using them. But [7:55] one of the problems with coding agents is like you  know your developers have free access to you know [8:00] essentially make make things with them and enter  whatever information and let's say they're putting [8:06] in company secret keys and by accident or by  intention whatever that is you don't want this [8:12] information to leave your enterprise environments  and go back to uh you know the cloud or the large [8:18] language models right and this is where a gateway  based in enforcement where you can actually check [8:24] for uh these things really you know really useful  and this is where you can also enforce policy [8:31] u on the full agentic behavior and and and same  thing once you are able to do this across a whole [8:38] set of agents uh you can then inventoriize them  you can actually start monitoring the full agentic [8:44] fleet right you can aggregate all of this data and  then say you can have like a data lake where you [8:50] can say okay like what's my uh you know what's  my full agentic behavior across the across the [8:56] enterprise and then have like a you know full sort  of auditable record of what each agent is doing [9:03] you know where where there is you know you know  unauthorized tool calls or or or sort of model [9:10] calls happening. So what is what is fundamental  to all of this you know what is new what is [9:16] actually the secret source behind this right so  there are two ways to build trust with agents [9:22] in order to monitor or evaluate an agent you need  to judge its behavior right fundamentally that is [9:28] the critical problem you know it's very different  from a traditional software system where you can [9:33] quantify its behavior I can quantify my software  application through tests through unit tests [9:39] through metrics that are much more deterministic  like throughput, latency, uptime, downtime. These [9:44] are all things that we have done probably  for decades. But with agents, the behavior [9:49] monitoring or evaluation is different. This is  where the concept of LLM as a judge has come about [9:56] in the last few years, right? Where you can say,  look, I cannot put a human to judge every single [10:01] interaction. So therefore, I'm going to delegate  it to a large language model which is, you know, [10:06] I, you know, which is can do this for me at scale  for every single interaction. Now what is the [10:11] problem of LM as a judge? Where did it start? LLM  as a judge started with pre-production evas right [10:18] where you had maybe a thousand you know samples  in a golden data set and you wanted to effectively [10:24] you know fine-tune your rag application you wanted  to make sure it's you know you can actually use [10:30] LM as a judge to evaluate it. But now we are  moving into complex agentic workflows where [10:35] you're running some of these agents in production  emitting tracets with thousands of spans and maybe [10:41] millions of traces per single day and this is  where LLM as a judge starts failing. So you [10:48] need an independent trust layer you know that  can actually do this fast enough that can scale [10:54] for the agentic traffic that can be independent  you know where you don't want the you want to [11:00] have a maker and checker problem check checker  separation where you want an agent that you're [11:05] making uh with like say claude can be judged with  a with a different model and that's where we have [11:11] invested we have been working on this independent  trust layer for the past few years where we sort [11:17] of built this centaur architecture which is a  system of uh multiple types of models. It's a [11:27] collection of small specialist models fine-tuned  to detect known issues like known sort of cases [11:33] like hallucinations, PII, jailbreaks, blah blah  blah and then also a hosted set of fine-tunable [11:41] open-source openweight language models that are  connected in an intelligent manner. So what this [11:48] allows us is at in a at a runtime given a span  or a trace level eval can be done using this [11:55] ensemble. So first you can check with the small  specialist models to see if it's actually they're [12:01] providing the right eval score. The key here  is to measure the uncertaintity of the small [12:06] specialist model. Right? So if I can actually  measure the uncertaintities, if I can know [12:11] that this particular input has come from out of  distribution, that can quantify the uncertaintity [12:17] score in addition to the classification score of  the eval and then I can route it to a larger model [12:22] which can give me uh much more of a highly  reliable score and I can use both of them [12:28] in conjunction so that I'm meeting my accuracy  requirements as well as my latency requirement [12:35] because that is essentially the trade-off today  with respect to eval class right the eval story [12:39] is all about can I produce accurate eval latency  can I scale for the full agentic workflow that [12:47] is the problem we are all dealing with and this  is basically an interesting uh system that that [12:53] we have sort of put into practice and and it's  actually working out pretty well and then in [12:58] order to actually fine-tune all these models you  need sort of a synthetic data factory uh because [13:04] when we work with our enterprise customers you  know most of them are not going to give us like [13:08] their data to train these you know small language  models ourselves. So we sort of look at like known [13:13] cases and sort of develop these synthetic data  sets to feed to these models and also it's useful [13:18] for adversarial attacks and security evals where  you know there's this every day that you're seeing [13:26] you know AI adversaries that they have the new uh  arms to go after they have they they're sort of [13:33] uh they're inventing new techniques to jailbreak  and and break into these LM applications. of [13:39] the data factory allows us to simulate these  scenarios. So that's basically the heart of the [13:44] system and it helps in three different ways from a  business point of view, right? It solves that one [13:51] problem of LLM as a judge. What is that? Basically  the high evaluation cost, right? Many of you may [13:58] be seeing that there is the as you do more and  more eval at runtime your eval costs are you know [14:06] climbing up to be almost close to your inferencing  cost sometimes much more than them if you're doing [14:11] many many evals per span in your agentic workflow  and that's actually pretty bad right so you want [14:17] your observability system or your controlling  system to be not as costly as your application [14:24] development right you want to have it like  maybe 20% or 10% of the cost. So we call it the [14:30] evaluation trust tax which means like you you have  to pay a tax to gain the trust from the evaluation [14:36] system but you don't want the tax to be 200% of  the expenditure that you're putting together to [14:41] put agents in deployment. You want it to be maybe  10% or 20% of that. That's what this centaur based [14:47] small models and the ensemble system allows you to  do it. Second is the risk exposure. Now what most [14:53] people do is because LLM as a judge does not scale  what they do is they end up sampling. They'll take [15:00] okay I'm going to take 10% of my trace logs and  only evaluate them or 1% of it because I'm it's [15:07] too cost effective. It does not scale. But then  you're exposing your company or your team or [15:12] your application to like 90% or 99% risk. You know  what if there is a PII event that happens there? [15:18] What if there was a jailbreak that happened in  that sort of scenario? Number three is for teams [15:23] that are you know that know all of these those  two areas they end up building small language [15:27] models themselves which is again an operational  overhead for you to fine-tune and keep them. So [15:32] that's basically what this batteries included you  know where you think about observability system [15:38] or the control plane as a car instead of relying  on a third party as a judge you know the centaur [15:43] models come with batteries into the observability  system so so for customers to monitor it. So in [15:50] our sort of measurements what we have seen  is these centaur models are very effective [15:55] in terms of cost right you know if you even  compare them to what's available on the market [16:00] say let's say openai GPT mini they are actually  90% 98% cheaper than these things especially as [16:07] you scale as you send more and more traces for  judgment you would see the cost of evaluation [16:14] is not scaling you know as along with them right  so it's kind of scaling more linearly [snorts] [16:22] So the advantage of these things is they you  essentially they come with out of the box [16:27] evaluators you know for all the familiar issues  uh jailbreaks toxicity PII hallucinations tool [16:35] call authorization and then you can also build  evaluators that are more GRC oriented let's say [16:42] if you are working in insurance industry you want  to have a set of NIC evaluators or you are working [16:49] in banking, you want to have SR 1117 evaluators  or there's EU AI act that just you know kind [16:54] of enforced got enforced over the weekend. So if  you want to create EU AI act evaluators, you can [16:59] actually define them in Fiddler of course comes  with these out of the box evaluators. You can [17:03] then also customize these evaluators uh for your  for your sort of uh sorry for your own business [17:12] needs and you can sort of deploy them. This is a  case study with one of our customers uh Neielson [17:18] which is a big media company. Uh they started  out with one of the LLM as a judge approaches [17:24] using an open source eval framework. It got us  it got them to a certain point. But in order to [17:30] launch their ask Neielson which is their flagship  agent that sits on top of their data infra and [17:36] provides you know question answering for their end  customers they needed a much more scalable system [17:41] and they've partnered with us and sort of helped  deliver that uh product to their end customers. [17:48] Now how does this help with coding agents right?  So uh so far we talked about mostly first party [17:54] agents. when you're thinking about coding agents,  many of us are using coding agents but may not be [17:59] observing what's going on, may not be tracking  ROI, may not be having guardrailing around that. [18:04] So with coding agents especially as they produce  these long traces we can actually observe every [18:10] single thing that's happening the tool cost the  LLM cost you know give you a full auditable record [18:15] and also evaluate per span for these longunning  agents and then also do redaction especially with [18:23] like PII and secret keys and we can also not only  do redaction we can also modify the secret key if [18:29] he needs to be and sort of obfiscate it so that  you know the LLM provider can see a different [18:35] secret key uh than what is being entered.  Right? So that's basically in a nutshell [18:41] uh what what I wanted to share here. Uh again  this is not a sales talk or anything. I wanted [18:47] to share this concept of control plane which  is essentially that trust layer that's coming [18:52] up and uh you know happy to take many questions  and if you want to learn more you can you know [18:57] go to our booth downstairs um and you know happy  to give you a demo detail. Any questions? Yeah. [19:14] uh you have built the models mostly concentrated  on what are the uh trust and observability but [19:22] have you focused on how to check whether the  answers or everything generated by the models [19:29] uh have you focused on those evaluations? Yeah.  So you you maybe the question is about can we are [19:36] we benchmarking our own eval models in terms  of their accuracy? Of course that's basically [19:40] the that's what we do right like because we  are trying to sort of our advocacy is that [19:44] like don't use LLM as a judge for everything  and you know this is much more effective. So [19:49] we compare them against all this sort of  uh content safety API of Azure or Amazon [19:54] bedrock guardrails or the other LLM as a  judgment open AI safety models and whatnot [19:59] and so and so that's basically you know that's  where the cost versus accuracy trade-off is like [20:04] where you want enough enough accurate evals  but at extremely low latency and low Trust.