Hello and welcome. This is Active Inference Gesturing 79.1 on April 3, 2024. We're here with Roto Kanai talking about meta representations as representations of processes. We'll have a presentation then a discussion. So thank you very much for joining and looking forward to hearing the presentation and talking. So go for it. Thank you very much for this opportunity to present our recent work. Thank you for spotting our very recent paper which just uploaded the preprint. So in this talk, I want to talk about what meta representations are. But to explain my motivation, I want to start from my kind of frustration in theories of consciousness. So a lot of theories of consciousness tend to be described semantically. And then, for example, in today's talk, I mainly focus on the higher order theories of consciousness. But it kind of makes sense at the semantic level, but when we think about how we can implement such high-level theories with neural networks, we realize there are a lot of uncertainties about how we might be able to implement them. But I think this is something we can call a constructivist approach. So by thinking about how to implement theories, we can actually reveal vagueness and make the concepts more precise. So that's the main topic. And so as I said, I want to talk about higher order theories of consciousness. Maybe many of you might have heard of it. But just broadly speaking, a higher order theories of consciousness claims that mental state is conscious, not just by having that processing, but it becomes conscious if it's represented by a higher order mental state. So by higher order mental state or higher order representation, generally it means it's a representation about another representation. So intuitively, I think this makes sense. So for example, when your part of your brain is processing something red, people ask whether that's sufficient for a conscious experience of seeing red. But when you have an additional representation that represents that you are processing something red, so that kind of mental representation seems to be functionally related to awareness. So that kind of makes an intuitive sense. But once we start thinking about how we can implement this sort of mental representation, it's very unclear what it really means. So we try to find a way where we can sort of represent the mental representations. But let me explain why it's difficult. Okay, so this is a very naive way to think about constructing mental representation. So let's say you have an image as an input and then there's some processing in the brain or deep neural networks, then you can represent the contents of the input or an image. But if you transform this first-order representation by another neural network, that's a really naive way to implement mental representation. But with this, you can easily have many mental representations. So let's say if we think of this as a visual information processing in the brain, this could be the retina, and this could be LGN, this could be V1, V2, and so on. But with this, somehow everything is just a representation of the first input. So somehow this doesn't work. Or if you think this is enough for mental representation, then everything needs a mental representation of something else. Yeah, so that seemed a little bit strange. And another way to conceive mental representation is to think about confidence. So in the context of metacognition and cognitive neuroscience, we often take confidence reports from participants in an experiment. For example, we could present some visual stimulus and then people report what they saw. If it's a color discrimination task, they could say blue versus red or something like that. But then you use this first-order information to make a perceptual decision, but also you can report the confidence of seeing that stimulus. So this is probably a bit better than just the very simplistic transformation as a mental representation. But on the other hand, if we think about implementing this, this is a very simple operation. So people working in artificial neural networks easily use something called Softmax where you convert this kind of representation to some sort of probability interpretation. So basically, if you convert activation patterns of this layer to that so that it normalized to one, then it is confident. So in a way, this is just one very simple transformation of first-order representation. So maybe this is still meaningful when we think about how the brain process this kind of uncertainty. But this may not be, at least it was not really satisfying for me as a way to characterize mental representations. So the main solution we came up with this idea. So we always tended to think about transforming first-order representation to something else. But here what we are proposing is to construct a representation of processes rather than these kind of states. So the idea is, okay, so any neural network can be conceived as some sort of function from input to output. But there is a way to represent these functions or processes. So instead of we representing first-order representation, we are proposing if we represent this function f to some meta-representation, we can have a potentially better interpretation of meta-representation because this makes a qualitative difference. But maybe this might be somehow confusing. So I wanted to give you an example using artificial neural networks. So that's the main topic of the paper. Okay, so here I just want to briefly sort of introduce the concept of latent space or embedding for people who are not familiar with this kind of stuff. So in artificial neural networks, there is a concept of encoder and decoder. And so for example, let's say you train an autoencoder neural networks where the input is an image and then output is an image. So basically you want to reconstruct the input using encoder and decoder. But there's a low-dimensional bottleneck in the middle. And then usually when you have this kind of construction, you find interesting features where the vector in this space captures the important characteristics of the dataset. In this case, images. So that's the idea. So basically it's a compressed nice representation of the dataset. But what we are proposing is to create some sort of meta autoencoder where the input and output are neural networks. So you can use a neural network which can be parameterized or represented by the weights and biases. You can use many different ways to sort of convert neural networks into some vectors. And then you reconstruct the neural network. So maybe you can already see this is somewhat meta. And so with this construction, you can have a representation of neural networks. So in this case, each point in this space corresponds to some sort of neural network or function. So in a way, this is a space of functions parameterized, like latent axes. So that's the general idea. So I hope you get the idea so far. And so from here, I want to explain the actual experiments we did. And so this is a little bit more detailed construction of what we did. So we first created a lot of encoders by training autoencoders for all kinds of different stimuli. So for example, like in one case, let's say we trained this kind of first order neural network just on cars or just on flowers. Or sometimes just the sound of dog barking and so on. So like each and first order neural network is specialized in some kind of stimulus category. And we use both visual and audio stimuli. But each network is trained on just one type of stimulus, one category. And so and then this encoder can be represented as 1056 by 16 elements. So like each column, of course. Okay, so here, like in the first order latent space, we have 16 dimensions and then input images 1056 pixels. And yeah, so basically, you know, you can see this number as the sort of parameter for this first order network. And then each column corresponds to, okay, so now you can see that this is a very simple neural network. So just one transformation. And then we took each of these as the input as a filter. And then we get like this kind of root. So okay, so one column here is a filter in this network. And then we use this as the input. So we trained another autoencoder to represent individual filters. And then we computed representation of this whole network using these two networks. So this might be slightly confusing, but the main thing is we get representation of network at this stage. And then we created another meta autoencoder using this kind of latent representation of the first network. So it might be a little bit confusing compared to the previous image, but this is more to deal with the technical aspect. But the main thing is we trained a lot of small networks on a specialized stimulus category. And then we tried to get representations of those networks. So that's the idea. Okay. And so then we applied, that gives me to visualize latent representations. And so here like all the blue dots correspond to some visual stimuli, some sort of category. And then the orange, the points correspond to some auditory stimuli. So that clearly you can see there's a separation between visual and the audio stimuli. So that's kind of interesting, right? So because this suggests that when you have a meta representation, you can already tell whether the network is specializing visual stimulus or auditory stimulus. So that's what we were excited about. But also, you might be able to see some clustering of same shapes. It might be a bit difficult to see this image. But there might be something like, you might be able to tell whether a network is specializing cars or buses or things like that. So we tested that by trying to predict the original dataset just by looking at the meta representations. So as you can see, there's a clear separation between modalities. But there's a little bit brighter diagonal elements which suggests that sometimes we succeed in predicting the specific stimulus category. So that's really exciting. Yeah. Okay. So based on this, since we can, there's already some information about the structure of the weight of the network, which tells us about what kind of information they were trained on, specialized in. So that's an interesting observation. But also, like we tried this in the original weight space, but in that case, we cannot really predict which category the network was trained on. So in that sense, you actually have to have this kind of meta representation to be able to make these predictions. Okay. So, but maybe one question is, why is it possible? So especially when we try to compare vision versus audition, maybe the key differences, they may have different kind of invariances or equivalencies. So, yeah, so for example, like in images, the object category or labels do not change if we make translation or changing scale and so on. So the classical convolution neural networks rely on this kind of invariances. But maybe for auditory stimuli, if you translate the input image or the sound differently, so you experience different kind of sounds and also the identity of the sounds changes. So there might be some modality specific invariances. So maybe after training a network, they learn to capture that kind of invariances. And meta representation may also find this kind of representation of invariances or equivalencies in the structure of the weight. So that's our current explanation why this works. And I'll come back to this later. So in a way, our experiment was also motivated by the classical question of what it's like to be a bat. And the interesting thing is we don't, so bats can do echolocation by emitting sound and then receiving sound, but they use it for navigation. So maybe it's like vision for them, but it's hard to say whether they are experiencing visual quality or auditory quality. So we don't answer that kind of question eventually in consciousness research. And so, but to introduce an interesting context, so this is a very exciting series of research from an American catharsis group at MIT in the early 2000s. And so maybe many of you are already familiar with this experiment, but they managed to do an experiment where they rewired the input from the retina to the auditory cortex. So yeah, I think it's like really amazing that they can actually do this sort of thing. Yeah, so but the idea is that their auditory cortex developed receiving input from visual images, the data coming from the retina. And the interesting, so they had several nature papers and they were all very interesting. But one of the key findings is that after auditory cortex was trained on visual input, their connectivity pattern looked more like normal visual cortex. So yeah, so this kind of connectivity to not their connection to other neurons with similar orientation properties. So somehow the connectivity seemed to reflect the sort of statistics or a structure in the data they learned. And but there's an additional interesting experiment, behavioral experiment they did. And the main question they asked is whether they see or hear the activation of this rewired auditory cortex. And the short answer to that is they, the animals seem to see the brain activities in the rewired auditory cortex. So that's like really amazing result. So yeah, so based on this, I thought that this could be a really useful way to think about whether we are, you know, whether some activities or some neural networks is more like for hearing or seeing. And so yeah, so that's something I always wanted to ask. Yeah, so maybe I've been thinking about like testing IIT using this kind of visual versus auditory, Gloria. And yeah, so the question is whether we can tell whether a piece of cortex is visual or auditory just by looking at their connectivity. And of course, you know, IIT is very difficult to apply and we don't know yet whether IIT is true or not. But at least we need to think about how we can test implications of IIT by empirical research. Okay, so this was what I was thinking originally. So let's say, you know, you take some, you know, like anatomy from visual cortex or auditory cortex, and then there are like many techniques to look at anatomical connections and functional connections. It's probably still very difficult to read out the weights from the actual brain. But if we have this, we should be able to compute information structures as suggested by IIT. And now we can probably match the structure to the report of, you know, visual quality or auditory quality. So that's the ideal experiment I wanted to do. But there are a lot of challenges. So the first one is in the actual brain, it's very difficult to have like complete characterization of anatomical connections. And, you know, it's also impossible to look at the causal patterns in the activation from all the neurons in questions. So that's very hard. It seems impossible. And another difficulty is the computation of phi in IIT is very hard. So, yeah, we've been also trying to compute some surrogate of phi or earlier version of phi. But it's still very hard if we want to compute phi from, you know, let's say, tensor than neuron. So that's pretty hard. And so, and also maybe a third thing is, you know, how can we match the structure of the report of experience to the structure of information? So that's, again, a difficult question. So, but this, you know, with the approach I showed you earlier, we can kind of replace some of the problems. So instead of looking at the complete anatomy of the human visual cortex and human auditory cortex, we can create sort of artificial neural networks by training them on specific stimuli, in this case, like sounds and images. So that's, you know, the great thing about artificial neural networks is we can see all the weights and connectivity patterns. So, of course, you know, we don't know whether they are conscious or not. But this approach gives us something concrete to work with. And another thing is about computing phi in IIT, we can do something slightly different. So there's a really interesting paper by Mediano and politics where they propose a concept of weak IITs. So if you take the original IITs, it has both mathematical and philosophical aspects. So that's my interpretation. But if we can use the mathematical implications, or if we use phi as an index of complexity or something, then we can use IIT in a more pragmatic manner. So that's their proposal of weak IITs. I think there have been a lot of empirical research driven by IITs. So I think that's a good thing. But here, what I'm proposing is more like conceptual IIT. So in the meta-representation work I presented today, I also took some inspiration from IIT as well. So the idea is that in IIT, some network generates visual or auditory quality should be fully described in terms of their connectivity patterns. So that's a kind of conceptual implication of IIT. But instead of applying the mathematical formalism of IIT, we just use autoencoder to find or embed neural networks in a practical, computationally tractable manner. So I think this kind of the conceptual IIT approach could be also a useful way to make progress in consciousness research. Okay, so the final points. So maybe one question is whether meta-representations as we presented today actually exist in biological brains. So that's highly questionable. So for example, today I embedded neural networks just by the weight of first-order networks. But in the brain it seems impossible to read out the weights from other brain regions. It may not be impossible, but it seems very unlikely. So maybe in the brain there might be a different mechanism to achieve this. So instead of using weights, if you have many input-output pairs, you can also construct a representation of that kind of relationship. So maybe without some figure or equations it might be a bit difficult to understand this. But let's say you have two brain regions, like v1 and v5. But if a third region receives input from both regions, the third region can learn to represent the pair of representations. So that kind of meta-representation may exist in the brain. And also we've been thinking how we may be able to find such representations with fMRI, so that's a topic for future study. And another question is what's the point of having this kind of meta-representation? So what's the functional role? So our current interpretation is when you have this kind of meta-representation, you can sort of compare different networks. You can have some sort of a qualitative characterization of first-order networks. So let's say you have meta-representation of red color processing network, or you could have meta-representation of many different first-order neural networks. But then in this space, you can talk about whether two processes are similar or different. So for example, in that space, you can say that visual experiences are very different from auditory experiences. But within the visual experiences, there are many different types of experiences. And here you can talk about the distances and similarities. So maybe it's a bit similar to the idea of what to back, where words are embedded in a later vector space. And when you have that kind of space, you can actually have some reasonable representations of semantics of the words. But here if you embed neural networks, you can have some sort of semantic representations of those networks. So that might be the potential functional role. So in a way, this already has a flavor of something like quality. So when we talk about quality, we always compare certain experiences to other experiences, and we can talk about whether or not two experiences are similar and so on. So in that sense, maybe this kind of meta-reventation might be very important for us to be able to report the qualitative aspects of the other one experience. Okay, yeah, that's all. Thank you very much. Thank you. Awesome. Cool. I wrote down some questions and also anyone watching live can write questions. Well, thanks for sharing it. And it's definitely very striking finding about the visual and the audio differing. So just kind of a preliminary question here. How was time handled in the audio setting? Oh, good question. Well, we just converted the raw signal into an image. So it's basically time and frequency so that we can use the same network for handling two different varieties. Yeah, interesting because it's also a difference between those two features. And it made me wonder about video, video chatting or watching a video, perhaps as being a meta-representation with audio and visual. Because if there's like a lag or if there's a disconnect or any other number of relations, it can be noticeable as a contrast. Like, oh, they're talking louder than it looks like they're talking or something like that. So I mean, have you looked at that kind of fusion or how could you look at it with the architecture that you had here? Oh, that's a great question. So we have very simplistic architecture since this was just a peripheral concept. But I think in the brain, we must have really multimodal representations at the same time. So that way, we should be able to compare different experiences at the same time. So that's where we get somehow close to the idea of global workspace. So we are not directly addressing your question, but we are on a separate project. We are actually training global workspace like neural networks so that they learn kind of multimodal representations. And also, so in that context, we believe it's very important to look at the latent space structures from different modalities and then see how they're related to each other. So with Riffin-Van Viren, we wrote a paper in Trending Neuroscience where we proposed that global workspace may be a kind of shared latent space across different specialized modules. So I think that part is also an important next step to understand theories of consciousness from the perspective of deep learning. Interesting. I found it also very interesting how you began with the uncertainty estimate. Because in active inference, a lot gets loaded on to uncertainty estimates of different parameters. And that made me think about, yeah, thanks for the slide. It made me think about if you only have two parameters to encode, then you can encode like the mean and the variance. However, with the neural network autoencoder concept, you could project down to just two or it could be more. And so then there's a much richer palette for and more bandwidth than just a statistical distribution, even though it's also composed of statistical distributions. But the minimal and the simplest and like the kind of most essential is really the statistical single distribution. But this is basically just talking about the connectivity of multiple distributions. Interesting comment. Yeah, I guess maybe crucial question is whether and how uncertainties are represented in the brain. So when we think of uncertainty estimation in terms of the two parameters, that's kind of mathematical notion. But uncertainties may be, probably we don't use just a single neuron to represent all uncertainties. So there might be also population representation for uncertainty. So in the actual implementation in the brain, yeah, you may actually use like many neurons as well. But I've been also very interested in this topic and especially the uncertainty estimation in the thalamus. So my friend and colleague, he found the uncertainty estimation neurons in the palpiner in the thalamus for visual experiences. So I thought that was a really cool study. And I thought there seems to be a close link between having high confidence and conscious experience. So I thought this might be like a really key ingredient. But somehow, like when we think about uncertainty in terms of deep learning, it seems like really trivial. So I feel like there's a gap there. That's very interesting. There's a lot of ways to go with that. In the last two points that you had up there, you returned to this kind of functionalist question, or at least just perspective, like what is it doing? So that made me wonder, when you look at the meta representations for the networks you construct, do they seem to convey something like summary statistics of the network? Like the sparseness overall of the connection or some kind of network descriptions? You also mentioned the differences in the stimuli type. So what parts of the meta representation reflect what the network is and then also what it does input-output-wise? So we don't know really what's in the meta representations of our networks. But maybe this slide might be relevant. So each neural network, the first-order neural network, tries to find good basis functions or good filters so that they can efficiently encode the images or sounds. But they really come from the statistical patterns in the stimulus. So that should be somehow reflected in the weight structure. So that may be related to these kind of invariances or grid variances. That's our speculation, but also for really specific type of things. So for example, these are all different kinds of specific stimulus like maybe this is air conditioning or car sound and so on. So they may have like really specific sort of structure. So then they may be embedded in the neural networks. But the interesting thing is when you train a neural network, you get different things every time. But they have something common across every training. But on the surface, they look very different. But across the results of many different training, different networks, trained on the same stimulus, there is something common across them. And so that's the kind of features we wanted to capture with metawater encoders. Okay, this may be reading too much into the image, but it's V for visual, A for audio? Oh yeah, yeah, that's right, yeah. The big off diagonal blocks are just the differences between the audio and visual that are solid purple. But then the audio stimuli has more a little bit with other audio. But then like in the visual, I don't know, it's like related to the syllable air. So it's kind of like a natural association, even though it wasn't trained, or maybe it's just because it's not a diagonal. Yeah, that might be some bias. Yeah, so this one, yeah, somehow the predictor thought like all the images come from this one. Yeah, but it seems like from this figure, different audio stimuli are very distinct, where it's like in visual things, what they seem to have. But this may be more due to technical constraints. So here we have to use really small patches. So maybe instead of looking at object categories, per se, maybe those networks looked at the texture patterns across different categories. So there might be still some information, but maybe they are not very specific to individuals just in this category. Hmm. Yeah, I think, I mean, you're shooting for the moon with a consciousness component, but even making simpler networks to understand what aspects latent spaces learn is a very useful method that I think this provides a strong example of. Yeah, I hope so. But also, since we work in the domain of AI research as well, we encounter something called mechanistic interpretability, right? It's a kind of field of AI research, where people try to understand what's happening inside neural networks because, you know, like a lot of people think deep learning is black box and we don't understand what's going on inside. But I think eventually we want to understand what's happening in neural networks as well. And it should be still easier compared to understanding the brain. So, you know, maybe, you know, in the context of our idea, I talked about this a little bit, but in deep learning, we know all the weights. We can do like any experiments, you know, we can do ablation or, you know, we can look at the function of part of the network and we can, you know, give them millions of trials. So it's like an ideal experimental setup for neuroscientists.  We cannot know the weights and connectivity. So we only have very limited access to the actual materials. So in a way, we can practice how to understand systems using simple neural networks and then try to sort of use that experience to understand the brain. So I think that kind of cooperation is potentially very interesting. Yeah, very well said. It reminds me of some work by Jonas and Cording from 2017. The papers called Could a Neuroscientist Understand a Microprocessor. And they had an in-silico simulation of a whole microprocessor doing different operations so they could do the lesions and the double lesions make all the recordings. And so that kind of revealed, on one hand, the limitations of different methods that people often use to ascribe function to the brain. However, there's always this component where it's like, well, maybe that's just because the processor is a weird architecture or because the operations that they do are very synthetic and they don't really have a natural component. Whereas when you're proposing that the base neural networks must deal with the symmetries of audio, visual, and so on, it's the kinds of challenges that organisms actually have to solve with nervous systems. As opposed to being software, which could have been written in an arbitrary way. And so the results are a little bit different, but it kind of makes the proof points, which is that to have the in-silico version that you can do the digital simulations on can help you identify where your studies are well-powered or not, and do all these other useful functions, even if they don't directly answer the question itself. Yeah, I'm also a big fan of that, like holding paper. So I think they made a really important point. So even if we have access to all the things, we still may not understand it. And it's hard to say whether the organic systems are easier to understand compared to synthetic systems. So I guess we just don't know. But without making any assumption, I think it's just very hard to sort of understand any computation happening in many different scales, not just in the brain, but inside individual cells, or maybe at the smaller scale or larger scale like galaxy. And so yeah, I think we still lack the science to connect physics to computation. So on a different paper, we also propose something called universality. So the idea is, so the point is a theory of consciousness should be also universal in the sense that we can apply it to non-biological brains. So like a lot of times when people ask whether current LNMs are conscious or not. But it depends on the theory you subscribe to. So the current theories like a higher order theory or global workspace theory do not tell us whether AI is conscious or not. But I think the reason is we need to define theories based on some physical system. So for example, it's hard to say whether an artificial neural network has a global workspace. We have those concepts, but when we try to analyze physical systems and then try to see whether there's a global workspace inside, it's very hard. So we need to make such theories universally applicable so that they can tell us about computations happening at many different scales correspond to their concepts in those theories. Yeah, that definitely kind of calls back to the alien slide. And if we had a tissue sample with only the static topology with no function, what could be assessed on a different note in active inference, I mean, half of it is action. So when we're thinking about variational auto encoders and the transformation from observations like down into state spaces, often that's in terms of the policy rather than only a compression, which is kind of like a sense making and reverse sense making layer. That's the predictive coding predictive processing origins, and then also to bring in the action representations. So that's kind of like being able to distinguish the primary audio and the primary visual from the motor courtesies. And those may have very simple or very sophisticated representations. But there are also ones that could be directly correlated with like bodily movement or muscle activity, rather than being correlated at some level if you go that way like with something you can't measure. Yeah, I think like here that we only talk about sensory experience, but like you said, I think some of the meaning of sensory experience comes from action or in relation to your body. So for example, without body, there's no up or down or left or right. So there's no direction, but you get this kind of direction in the visual image or reactivity in your body, for example. And also maybe you get kind of representations related to affordances. So whether something is actionable, that also relies on some combination of sort of action and sensory representations. Yeah, but I think it's very interesting to think about how we can extend our current research into, you know, more like agent based architecture. That makes me think of the possibility that the meta representations could be higher judgments, whether those are experienced. So like a very cross modal judgment would be like, can a human make this? And then that could be asked across modalities or could reflect multiple modalities, but it has to draw information from also not just the sensory data, but like other kinds of memory. It connects with the broader cognitive modeling and the agent architecture, whereas here it's really reducing it to just the streams of vision and audio, which is the right starting place. And then there's going to be other streams that aren't just the sensory. Oh, okay, yeah, that's a great comment. So this reminded me of something I had in mind and forgot to mention. So we are thinking of this kind of meta representation as one of the modules attached to the global workspace. So when you have something like global workspace, you want to use functions, not just from the sensory inputs, but you want to combine that with action, reward, and so on. So in principle, okay, so we want to use representations of potential actions or even like mental operations. So like, you know, adding two numbers is a kind of mental action. So when you try, so we are actually thinking about connecting this kind of meta representation to general intelligence. So when you have a new program, you have a representation of the task. And but to solve a new task, you want to find a potential combination of, you know, specialized modules you can use to solve that task. So in a way, this kind of meta representation can be used to match the tools you have in your brain with the current task. So in that toolbox, you don't just have this kind of visual representations, but you may also want to use potential future actions you can use. But you can also use the same meta representation approach to represent the repertoire of actions you can make. So that's the connection. Yeah, potentially in the active inference model, like you had the slices with the different filters, the B matrix in active inference or just the transition matrix, it's the policy dependent transitions on the world. So that's kind of like the policy dependent filter applied. Yeah, yeah, yeah. That's a good connection to it. And then also on the thalamus, I'm not familiar with the mammal neuroanatomy very much. But when you said that clarity was important, did you mean like what? Yeah, so I think a lot of interest in confidence or metacognition comes from the literature blindside or blindside like phenomena. So it seems like even when you have the ability to report the stimulus, without confidence, you know, you report, you didn't see it, right? So it seems, you know, this kind of confidence is explicitly present in the brain, so for example, like in the thalamus. And so when you deactivate those neurons, somehow, you know, at least in monkeys, they lose the confidence. So in terms of confidence rating, they seem to become like blindside patients. So in my introduction, I kind of criticized the kind of simplicity of confidence as metarepresentation. But at the same time, in the literature of consciousness research, it's also very important, right? So somehow, without confidence, you don't really report it. But I think maybe we need to have further studies about how confidence or lack of confidence changes the way information enters something like global workspace or some stage of consciousness. So I think that's really likely in the context of precision weighting and stuff. So without confidence, maybe confidence works as a way to get information to something like global workspace. I don't know, maybe I talk about global workspace too much, but I think it's a good way to think about it. Yeah, I agree. These are just like kind of the labels and the models that can then be applied. So what that made me think of was, again, an active inference. If we're thinking about attention or precision, confidence, it's usually just one variable in the minimal case, just changing the variance on a statistical distribution. Latent spaces makes it much richer. So then let's just think about what sources are we paying attention to? Which sources, if are we allowing to ignite the global workspace or have more of a percolating effect? And then there could be like, it's like the dinner party problem. So one part of the problem is just distinguishing and interpreting the sounds. So that might be a simpler like left side louder or quieter or moving or something like that. But then you would have a higher order evaluation space with like this person, you can trust on this topic and that topic, but not this one and vice versa here. So that's invoking more of the world model. And then that could control to what extent different things that those people said after they'd been parsed out. So like the primary sensory mapping is simpler, because this is just a very sensor actuator type problem, whereas the higher order latent spaces could be just very large. Yeah, I guess maybe for like a simple, the presence versus absence kind of judgment, this confidence may be critical for a stimulus to enter conscious awareness. Whereas probably meta representation I talked about, maybe more related to sort of evaluation of the quality of the content of consciousness. So if we want to make comparisons across like different sensory experiences, we need this kind of meta representation. I think that's a kind of different aspect of metacognition. Yeah, so I guess maybe like in like earlier days of consciousness research and people did a lot of like present versus absent report and it's all about detection. But I think detection is very different from kind of qualitative assessment of experience. And so I think it's kind of transition in the focus of consciousness research from, you know, like present versus absent report versus more like structured report, like comparing like two experiences are similar or not. So I know now it's GS group has been like, you know, developing these methods to sort of capture for your structure. So I think, you know, we want to understand why certain experiences feel the way they do, like, and then that those things seem to be very difficult to approach. But by looking at some comparisons of different experiences, it seems to be able to capture the overall structure of the experience. So maybe our meta representation approach here is also more about capturing more sort of structured structure of the quality of experience, rather than, you know, whether we consciously perceive something or just subliminally process. That's a very interesting point. It's almost like the early global workspace and ignition were focused on the extent of the causal efficacy and the binding. But it was sort of left for later what the semantics or the contents were, because the question was, at least from how I've seen it, more like whether it percolated to awareness or not, or like whether there was a binding or a reportable versus unreportable stimuli. And so it totally makes sense that within the space of the aware, the question of how to bring it to awareness is kind of already taken. So then it requires a much richer state space like you have here to even approach it because it's just not an all or none question at this point. Yeah, I agree. I think that's a really interesting tradition. Although I feel like we haven't really solved this reportable versus unreportable question yet because we still don't know where consciousness is really happening in the brain. But I think we need just several different approaches to tackle the same problem. Cool. Well, I guess sort of in closing, what are you going to continue working on or what are you excited about? So we want to do empirical research based on this. So I think here we are proposing a new way to look at meta-representation. So one thing we are interested in doing is to find whether such meta-representations exist in the brain. So that's an open question, but we have some ideas about how to try that. And another thing is, this is kind of beyond my ability, but there might be a way to do this meta using mathematical tools. So intuitively, so now like some people talk about category theories and things like that. So it seems like what we are doing can be made more abstract and formalized so that we can have better insight about what we are trying to do. So here what we did was kind of like naive way to express our thought about meta-representations. But here, so we are kind of transforming functions into an object. So basically one function is a point in some function space. And this point in functional space seems to be somehow related to Korea, so that's my current intuition. But I think in mathematics there must be useful tools to deal with this sort of idea. So I'm curious if there's any mathematics that can formulate this nicely. I think that would be an interesting thing to do next. Very interesting and also to the little I know about it and people have discussed it. That is sort of a category theoretic move to have a handle like a point around a mapping so that you can have the space of the models. So you took a very constructivist engineering empirical approach and then it's an exciting open question like what are the formal structures that generalize that? And then you could spin up a million experiments just like the one that you probably built by hands and then learn from that. Pick up that as a point. Any last comments? Oh, I have just one announcement, which is this one. Yeah, so sorry about advertising, but we have a consciousness conference called ASSE. I think that's one of the main consciousness conferences. And that's happening in Tokyo this July. So if you're interested, please come. I'm one of the main organizers. That sounds awesome. Cool. Thank you very much for this presentation. Good luck with the work in the conference and hope to talk to you again. Yeah, thank you. That was fun. Yeah, see you. Thank you.


Previously on the Future of Storytelling Unit 2.1 Weekly Formants on Serial TV The serial tells an ongoing story episode by episode. Let's dig a bit deeper and look at how writers create a mystery. A procedural is in its core a series of standalone episodes that is premised on a so-called case of the week. Keep that in mind. So let's look at how these differences between procedurals and serials show in the way procedurals or serials are written today. If you take a show like CSI, maybe as an example, which would be one of the most successful procedural shows worldwide, stories there start in very different places. So one of the biggest questions that a writer's room will start with every episode is, where does the murder happen? Because where the murder happens will dictate a huge amount of how the story evolves and how the information that we give to the audience is discovered because it's all got to tie in in some way with what's going on. So the actual arena the story takes place in becomes hugely important and they actually can't move into actually breaking the story itself until they actually figure that out and figure out what they call the clue path. In each act of the episode, we need to reveal a new piece of information which takes us in the direction of solving the crime by the end of the episode. These are obviously not the first questions that begin in a writer's room that's dealing with an ongoing serialized drama. The guys in Breaking Bad are not sitting down in the room going, okay, we're in a meth lab. What happens to the person who dies? How does that tie into it? So there are quite specific differences. That means the writers of a procedural have to deal with a case, for example the murder, first when panning down an episode. To be able to plot the whole episode, including the clue path, it's equally important to set an arena, a place for such murder. The clue path in this case means the path to the truth, the resolution of the mystery. With all its right and wrong traces in between, the wrong clues sometimes called a red herring, for example. But why do the writers have to design this arena, this mystery, and its setting first? Because it, for example, matters whether our investigator has to solve the crime of a dead mafia henchman found stabbed in the Dodgy Harbor area, or maybe the suspicious looking drug-related death of the president's niece in her high society loft. These decisions will very much influence the story and the secondary episode characters that one needs to develop to tell this story, this case. In contrast to that, in a serial drama like Breaking Bad, The Tudors or Game of Thrones, a murder happens due to the developments of the story, not in the beginning. The place and the time, not being the incentive for the episode story arc, but part of it, and its characters' behaviorisms. Can we really always divide between procedural and serial drama, looking at current TV shows? There are people who tried to meld the two worlds, some very successfully. Bones is a procedural, but it's also an ongoing drama to a certain extent, same with The Good Wife. There are people who have been less successful. I don't know if you're familiar with Kyle Killen, who is a writer, creator, showrunner. He did Lone Star and he did Awake, and Awake is a very interesting case study. I went to a talk that he gave in LA, which I just found really fascinating, because he was very honest about all the reasons why Awake didn't work at all. So basically what he did was, he had a pilot, which I don't know if people are familiar, I don't know if the show earned in Germany enough, but basically Jason Isaacs is a police detective who's involved in a car crash, and his wife and child are in the car with him. And his life splits into two alternate realities, one in which his wife survives and one in which his son survives. And he's not sure what reality is anymore. What Kyle thought he could do with that show was get a writing room that was kind of split 50-50. Let's bring in a number of writers who have experienced doing a whole lot of police procedurals, and let's bring in a whole lot of drama writers, and we'll let these guys sort out the police story that we need to solve each week. And we'll let these guys write the drama, and then we'll just blend it at the end of it. Six episodes in, they had to shut down production, because this was a fundamentally flawed approach to trying to do this. It just wasn't working, because the demands of what the procedural required versus the demands of what the drama story required were just becoming overwhelmingly complicated to try and make those things work. And I think that's an example of how fundamentally different those two things are in terms of story structure, and the way you go about producing them. A couple of years ago, it was all about episodes, providing storytelling that you can watch whenever, and you can tune in, and it's like bones and CSI, and if you missed 50 episodes and still get in, maybe it's different phases, but it's pretty much the same thing. You get a dead body and you have to solve it, did it? But looking at that, I think that has changed over the last few years. The way you also watch, because a lot of people watch, don't watch it on TV anymore, they buy the season, and they watch them a whole Saturday, a whole Sunday, and then they've seen like 22 episodes. So that allows you to watch completely differently. So I say the trend has moved from episodeal stories towards a more arc driven, more horizontal storytelling. To answer the question of whether the two narrative storytelling structures of procedurals and serials can be easily separated in today's TV? No. At least if we believe Rebecca and Des. Veronica Maas and the mentalist visualise what Des calls the melting of both worlds, a trend in TV series right now. The mixture of classic procedural parts, like the episodic case of the week narration, with the characteristic of a serial, the ongoing story arcs, like in the case of the mentalist, protagonist's Patrick Jane's search for Rajon, the killer of his wife and child. With Rob Thomas' teen detective series, Veronica Maas, to come back to that, we can find a similar base with the weekly self-detective cases versus the season case arcs and interpersonal relations, e.g. between Veronica and antagonist, or love interest respectively, Logan Eccles. Although it doesn't seem possible to explicitly classify many series, having in mind those two models is important when trying to analyse and differentiate between series formats or creating new ones. Why? Because models are the human minds way of understanding complex and diverse processes by classifying and simplifying them. If we look at film genres, for example, like the western, the romantic comedy or the musicals, the same process applies. David Baudwell and others have already researched in the 1970s. Genres are just categories created by producers, marketing managers and critics based on similarities in visuals, narratives, characters and even more. This doesn't mean nothing else is possible apart from that or done. Just that those hybrid formats are more difficult to grab and therefore sell to a viewer or to a broadcaster. In case of teen detective series Veronica Maas, which shows elements of film noir, crime procedurals, serial mystery arcs and high school drama and also comedy, this might have led to an early death of the show on TV after three seasons. It, however, notably made it so special that a movie is in the making, sponsored by the well-documented Kickstarter campaign by fans. That means whether you create a story based on a well-known structure or decide to remix models, structures and tropes in a new way, both can be done really well and successfully. Yet it's really good to know your ingredients to the mix first.


All right. Welcome everyone. I'm your track host for this session. My name is Pushkar. We have chip and brand. We're going to talk to us about path to production Sustainable compliance in strict environments Chip Brian Hello, everyone. Thanks for being here. This is our session path to production sustainable compliance in strict environments My name is Chip Zoller. I am a technical product manager at their moda and also a cover no maintainer Everyone my name is Frank killer I'm a software engineer at defense unicorns and kind of our talk today is to kind of walk through some design patterns around You know, how can we create? sustainable compliance in these Regulated environments and really regulated is called out here because it's more of an extreme case But as we look to commercial environments, I mean as we look to just general our dev environments We want to be thinking about okay. Who does this impact? Why does it impact should I be looking at specific things about my data, etc. So we're going to kind of walk through a couple things Stick with us to the end. We're going to have a demo to kind of walk through some automation That'll be a little bit more exciting But we definitely have to set the stage right a regulated environment. What is it? Typically, if you think about that your your health care financial Government, etc Some of these environments that we're building kubernetes on various cloud providers. They need to meet compliance with a certain set of standards ie your NIST a hundred fifty threes, etc and We've been doing it for a while now. It's you know, it's working for us But how can we start to push into you know, what's what's the best path forward? How can we automate compliance as a part of how we're delivering software to these environments? And so there's there's definitely a lot of things that go into that The like optimal scenario that we're talking about here with regulated environments is we want to know Absolutely to the most granular layer like what is being introduced into our environment? And I think that's very important. I think we're if we're thinking about kubernetes in particular We're definitely at the cross-section of GitOps with declarative configuration It's going to be pretty explicit about hey, this is what I'm changing I'm making the change in somewhere that requires approvals and reviews in order for it to then be introduced into the environment And on top of that or maybe as a layer below that we can think about Like what other systems come into play with compliance, so if we're doing the best case scenario for GitOps then below that right is it's introduced to the environment and Things are running as they should But what about at the you know access control to to that cluster? We want to really prevent this cluster from drifting from that configuration And so we prevent like manual modifications as much as possible right we're restricting access for who has the ability to go and Touch any of that infrastructure, but also having tooling in place. I like policy enforcement tools That can restrict certain actions from ever being conducted against the cluster And so that kind of sets the stage for like what a regulated environment is one of the the big key pieces I think of sustainability in compliance is Trying to get away from this Not invented here syndrome When we think about even commercial environments, we think about enterprise environments government, etc And in Kubernetes we're all leveraging similar stacks of products that are providing this common baseline We all need logging in our cluster we all need ability to monitor what is going on there we all need ability to enforce policy within that and These are very important, but what we don't need to do is we don't need to go and write all of our own orchestration and tooling Around that right we can leverage open source many of us. That's the very reason. We're here To go and really provide a lot of value We can say like who has the the most intimate knowledge of the logging stack will probably the maintainers of that logging stack They can tell us all about the decisions. They made and the capabilities it provides and we can we can leverage those ecosystems and like Probably for the greater portion of the last Decade we've been hearing a lot of things come out dev ops dev sec ops And we really want to They mean a lot of different things to a lot of different people and we really want to start to get into how can we collaborate on solving some of these problems Kind of an instance of this that we see kind of within the government space would be platform one and kind of that big bang kubernetes baseline for Compliance with the dev sec ops reference design from the DoD Department of Defense I call this out because again, it's it's a baseline It's open source and available for people to pull from that starts to think about how do I integrate my logging stacks with my service mesh And this is done elsewhere. It's not only done here But it's worth calling out that we're we need to collaborate on these things in order to provide like the best capability the most secure that it can be and You know, this is ultimately a common denominator across all of industry Healthcare, etc.  I originally want to say like reciprocity needs to die But I kind of started thinking about it some more and it's really, you know reciprocity this idea We're gonna we're gonna practice the exchanging of things for mutual benefit and how can this apply to us? How can this apply to dead-sec ops? How can this apply to? regulated or unregulated environments your death environments, etc and so kind of as a precursor to that like CNCF we're building applications. They're they're cloud native by design. They're they're meant to be scalable they're meant to be extensible and configurable But what happens when you have all of those things to meet the one node cluster of the 1,000 node cluster is that largely There's a lot of ability for those even if it's the same application There's a lot of ability for that to be different from the small to the large that You know the single to the scaled and so if we start to look at some of these things How can we think about you know what information is really pertinent for compliance? And that's where I think like reciprocity needs to be involved here to get away from the historical thinking of I've I've met my tests for compliance received my you know stamp for the next year. That says I'm good And no one's gonna check it in between then And here's why here is why I'm secure and get away from that and kind of move towards the like the how How am I secure? How can I reproducibly you know ingest any piece of software in the open source? or proprietary etc and When I have that how can I go and validate that it meets compliance with controls and This is really a space where we want to kind of like key in and target That's going to be largely important. And so I think this kind of falls into two two bins of different You know styles of work one is Compliances code if you've been in compliance work before if you had to run through NIST a hundred fifty-three Those standards are there for a reason and you know they're providing a lot of guidance and a lot of direction for how to secure systems But at the same time if you run a check and you get your stamp And then that ultimately sits in a document and doesn't go anywhere doesn't do anything doesn't evolve Then it's not it's not a living breathing document anymore, and you're gonna have to redo all that work again the next year and so There's this you know concepts that we're really pushing towards compliance as code We no longer want the Excel spreadsheets and the word documents etc where you're checking the boxes for yes We met a c3 But instead you're documenting in code in something that can be version controlled because we know the goodness of version control And and what that brings to us for the ability to audit and non-repudiation etc That we can we can really leverage the goodness in that and I'm going to show example here in a second of what that looks like But it it gets back into you know these are things that we can continually Evaluate we can make a change in the code base for a tool and we can then immediately say you know as a as an approval review process Is this changing my compliance controls? Is this changing what can be? Satisfied as part of that And so kind of as a General overview here. I'm gonna show a quick example. Don't read into it too heavily I get that it's a lot of text you have to parse through But the the general concept here right is for any given control if we talk about any given tool For instance, we're looking at service mesh from Istio And if we want to start classifying that hey if I use Istio as my service mesh What controls may be satisfied as part of that with this universe of controls? We can start to say okay. Well from a hundred fifty-three. We can this control AC three is satisfied under these conditions That's all great information. It's a lot of good direction that we want to push towards for what it what can be satisfied And we can also you know move scale that into Multiple sets of different standards that a tool might be compliant with whatever is most applicable to your environment And most important to you and start to classify this preferably with the upstream in such a way that it's controlled there Those who have the most in-depth knowledge of the tool can provide a lot of background for what is going on under the hood But one thing to note here is that this is the universe of controls These are things that can be satisfied by the tool And ultimately that's what we've been doing with our checkboxes. We've been doing some checks under the hood For yes, this meets this because of this awesome. I got that documented and available But it doesn't live it doesn't allow us to build stacks that can be you know Inherently aggregated if I want to deploy Istio and my logging tools and my monitoring tools each one of those should have these documents kind of Living in their code bases such that I can point at them. I can aggregate all of them and then within You know Seconds I can say here's the full list of universe of controls. Let's go and let's go and validate that somehow We're going to demo that here at the end that we're going to actually start to actionably automate that process And start to work out how can what does automation here look like who is involved? It's certainly not an end all be all right now. We're not done with it. It's not solved Compliances largely in ever-changing space, but Definitely worth consideration And so if you've got you know as branch showed you've got the definition of what Compliance standard that you're trying to meet and you've got that as code The next thing that you need is policy, which is kind of the glue that binds the controls to the actual configurations, so your compliance is going to be met by the tools that you're using and their Configuration well you have policy that can cover those things and perform validation on the tools And if those tools change then you have a set of policies that's for those tools So policy can really be the glue that binds the controls that you need to specify in the compliance to the compliance stocks through their Configurations, but the good thing is that we already have policy as code If we can have compliance as code we can marry that with the existing policy as code through one or multiple policy engines and store those things together or maybe separately tightly couple or Loosely couple those things together and be able to meet an entire compliance standard with code And so in this demo We're using caverno, which is an open-source policy engine built specifically for kubernetes. It's an incubation project Maybe you've heard of it But using caverno you can validate these configurations that satisfy the controls and also do things like ensuring software Supply chain security so whatever images that are being that are associated with those you can do things like verify that they have Signatures if they're attested and hopefully we get to the point where more of us are at least doing image signing verification Doing attestation verification. You can also ensure Through policy with the same engine that these images have been attested to and that even the contents of the attestations Are whatever we expect And with caverno, which is nice To be able to sort of get everyone on the same page with compliance. There's no programming language That's required. So not only is that easier for you But it's also easier for your auditors and maybe you want that maybe you don't want that but You your auditors are at least on the same page And everybody can read a simple YAML definition without having to parse maybe even an esoteric programming language to understand Alright, here's how we're meeting compliance. You can clearly see the definition. That's here. It's fairly straightforward and You know because we have policies code you can version control those policies as part of that compliance So you keep your compliance as code you have your policies that back to it as code everything's good and You're able to use your existing tools to then modify and manipulate those policies so things like namespace exclusions Like if you're deploying these tools in a kubernetes environment, you're often going to have some form of exclusion I need to exclude based on namespace maybe based on label. Obviously, you know you your organization Maybe your auditors need to get involved to try and understand that but if everything is as code It's a simple readable YAML definition and makes it super simple to not only parse that but also to programmatically manipulate that with your own tools and The other nice thing and indeed a necessary thing is we need to be able to check these things Throughout the delivery process. So not just ensuring compliance is running in the cluster We obviously all need that but we want to make sure that the start of the pipeline the entry all the way throughout that These things that are could be introduced remain compliant and with the use of like the Coverno CLI This is a perfect match in pipelines because now you can ensure that you're manifest that you're about to introduce through that PR That they remain compliant to your compliance standard mapped all the way down to the policies and you can have all of these things as code So some of the things in the future that you know if we're successful in doing this And we if we get enough traction that the world where we'd like to kind of get to is The ability for auditors to sign these policies So one of the neat features that's in Coverno one dot eight which was released earlier this week or at least the announcement was You can YAML sign your policies or you can YAML sign the definitions that are coming through your pipeline And if any tampering has occurred in that the signature will fail validation Not only will it not get pulled, but it won't get run and that's in addition to the image signing verification But also, you know, we've got this oscal definition that defines the compliance standard that we want We have a set of tools We should be able to decouple the compliance from the set of tools from the engine So these things are all loosely related but decoupled so that you can have different policy engines and Your set of tools that you want each tool maps to a set of policies and all of this is stored in version control as code everything from your compliance to your tools themselves to the policies to your engines and all of that's bound together and Kind of setting the stage for the demo So what we have what we've talked about right is we have these oscal documents. They're machine readable And so as such we can start to build automation that naturally organically facilitates reading that information and Taking some actionable steps for how do I how do I take the the state of I have the universe of controls that we've been talking about and Find out what is actually satisfied given the configuration of My environment of the way that I've deployed the tools of how I've configured them And this is really important. So if we take that oscal document and then we start to Run it through automation produce reports also in oscal so that all of our GRC governance risk compliance tools can read them with following the NIST standard for oscal in the schemas We can really get to a state where I've deployed a tool. I've checked that these controls are satisfied as part of my deployment of that tool and I've immediately made that available for the GRC tool to visualize and this can be a very continuous very event-driven process I'm going to show a CLI driven version of it, but it could be something that's continuous We can get to continuous compliance in the form of any change that's introduced into my environment I want to rerun checks against what's applicable. I want to rebuild my entire SSP for what is automatable and make that Visualized for whoever the persona is that needs to see that information if it's a car Authorizing official that needs to say yes, you're still in compliance. They should be able to go to That service that GRC tool that visualization any time and see the real-time compliance of that environment we're getting away from These checks where you know auditors came in they did the check and said it's good. I'll see you in a year and at any point in time not only can we visualize it but also the oscal compliance and the Documents that are being generated about what is satisfied is still the how we've translated the how from The tool makers the open source the upstream proprietary whoever We transferred that to those who are operating the environment and ultimately that gets has the ability to be transferred on to Anybody who audits so if we want to again have third parties Looking at the environment and validate it then that is an absolute option and it should be reinforced So what I'm going to do is I'm going to try a live demo, you know wish me luck but Really around the idea that on the bottom there very small text apologies You're going to see I've got a live Kubernetes cluster running on my machine. I'm just going to represent my environment And what I'm I'm going to be looking as I'm going to look to introduce a workload that I'm going to say does this the state of my Application this this workload doesn't meet compliance with a control We're going to we're going to run through validating that scene past fail scenarios and what that means And and then from there start to kind of run through That full that full end-to-end process So I'm going to start kicking off. You should see on the top here. I'm going to do it as we go I've got my You know air gap delivery tools are to kind of help me with this process because I'm Not going to rely on Wi-Fi. So I'm going to have everything I need locally and be able to Deploy applications to this cluster without the need of internet and Wi-Fi So the first thing that we're going to look at Is and this should be coming up here is That oscow component definition this oscow file right that we want to say we want to ingest And so there's again, you're going to see a lot of things here for what this looks like we're going to use Istio as an example and There's a lot of data in oscow bear with me. I'll point out like what's immediately The most important is really when we get to These implemented requirements. We're pulling from 853 as you kind of see there in the center And out of that we're going to look at okay for the given state of my environment Can I go and validate that some control is is being satisfied? today we're going to kind of look around the idea of AC4 and High-level, you know, how do you systems within my environment communicate with one another? For the service mesh People who are familiar with service mesh really we want to get to sidecar injected environments for the state We're not using ambient here at the moment But if we can go and validate certain things like is the sidecar injected we can start to really hone in on yes You know workloads are going to use MTLS to talk to each other And that way we can really you know dive into how do our systems communicate with one another one another and are they? Compliant so there's a lot of descriptive information that tetrate has done with the previous production of this Which is awesome. We want to know From those who are most familiar with the applications How to go and validate that a control it has been satisfied But what I'm going to point out here is kind of this rule section and this is something that we're working on with NIST for Oskow is Creating fields that we can go and automate we can evaluate with automation and then we can go and Prove out yes, this can be satisfied and let's go run the check. Is it satisfied is the control satisfied by the environment and so we've got Kind of a field here. Those are familiar with Kieferno. We're leveraging Kieferno engine under the hood To provide us with validation of kind of what that environment looks like So let's kick it off. We got our Kubernetes clusters on the bottom there What I'm going to do is I've got a ZARF package. I wish I could explain more about ZARF. Sorry for my ZARF friends But I'm going to deploy a package. It's all local to my machine in this package compressed tarball and I'm just gonna say we're gonna confirm it and then I'm going to set a label here really quick for True and this is gonna say yes, I want injection on this application For this package that I'm deploying and so I'm gonna go ahead. I'm gonna kick off the deployment of this workload and so you should see that introduced there and Yeah, as such You're what you're gonna notice about that is we can See that there there's some common things we can point out really quickly two of two I hope I can barely see this from my vantage point but The general idea is we're going to be checking to see if this thing is compliant with the control that we are looking to automatic that automatically validate with automation and so It's deployed and we have an oscal Definition that we can ingest with our tool Lula to go and then do An evaluation is this in the correct state? And so what we'll perform next is A Lula execute and this is going to ingest that document and then go and perform a Live check against our live cluster to see if it's in the right state so if we If we do that What you're gonna notice here immediately it's gonna go and apply kind of a policy-based check Against this environment you're gonna see things like hey resources passing one There was only one pod there to really go and validate against for this control to have been met. It's very high-level Check of this control not by any means completely fleshed out for what does Meeting a c4 across your full environment look like but we want to demonstrate this capability and so it's passing wonderful what this does in the interim is generate a Compliance report looks like I have a couple here And so 12 And so just kind of generic pass information What was it that passed so that we can then feed this into GRC tooling? We've worked with kind of partners in the past to Integrate different pieces together to really get to the continuous compliance framework And so there's information here that's pertinent to that But let's change it. Let's make it invalid So with our our ZARF deployment here, let's purposefully remove the injection of the sidecar from the service mesh so that it It couldn't communicate with anything else in the service mesh via MTLS and so We will run that and it's going to start deploying Any workload start terminating the old And now our updated version we've changed something. Are we still compliant? With the given control that we said we were And so it's it's simply a Let me remove these real quick and then It's simply a rerun of that loot that all-scow definition for what is meant to be compliant We're not telling Lula that anything has changed We're just going to be an auditor perspective and go and validate that that is the case So we'll execute and kind of as expected Super exciting it's now saying it's failing Right and so this is This is where we want to get to we're doing these checks against live environments We can do these checks with static manifests as well. And really we're we're looking at how do we? Help NIST evolve Oskow that we as an ecosystem open source Assist with that and then how do we start producing? Oskow Models that are really going to facilitate the end users of the operation of the environment everything from conducting assessments so if we take a look at That compliance report it's going to be telling you it's failing And that'll be that can be made immediately ingestible by GRC tools and Yeah, that kind of covers what we're looking at currently wanting to extend this outside of Kubernetes, but there's definitely a breadth of breadth and depth of you know discovery that still needs to be done in the compliance space How does Oskow need to evolve? How does Lula and other compliance engines need to evolve? to really get to a point where we can start to cut out You know tens hundreds thousands of hours worth of repeatable compliance Processes that are being done every day everywhere in every regulated environment And get to a better path forward so with that any questions And I come right to where you are. Okay. Have you guys seen any Resistance to moving away from the rubber stamp yearly audit I'm just going through an event with my CSO team who don't want to approve pull requests Any guidance for me Other than cell Yeah, that's a tough one There's going to be a lot of a lot of variables involved there. I think like if we Get to you know these frameworks where We're we're actively iterating on like how do how do we prove out the provenance of these queries, right? If if you looked at the high-level version of what we saw today It's it's not every single check that needs to be performed that we need to write that query We need to iterate on queries like those and in your instance of you know Resistance to change resistance to you know what's being introduced, etc. Like It's going to be very tough But I think that the the common denominators here are like We we ultimately want to to get things changed and updated and maintained because Vulnerabilities and kind of the risk that comes with not changing But how can we automate out some of these processes? Maybe compliance with certain controls is a path forward for You know proving out that something should be changed. It is your pipeline You know go and check like hey if I introduce this change is it going to Violate a control is or is it going to introduce something new is it going to introduce a new control that I am now compliant with because I've ingested that and I think there's a lot of possibility here to kind of leverage that to I Really wish I had a polite way to say this to help cyber with you know coming into the the dev ops The dev sec ops pipeline perspective not that they are not that there aren't people that are but These definitely have to be very cohesive teams Cheers So it it looked like from what you presented that That istio like upstream provided that list of controls that they could be satisfied by istio and then You've got the policy to check that can you just comment on What different people in order to make this a reality in terms of actually pushing all the way forward To like an authority to operate or something like that What would the different responsibilities have to be what would have to happen from different organizations? Yeah, I think that's fair Really it's It's leveraging kind of all of these open source communities to to start providing some some baseline and again Open source what's good about that is if you're very passionate about Compliance maybe you are contributing it to an upstream source But the idea is like have this live as close to the source as possible Again, so that those who are well versed in an application can Be able to evaluate those controls and look at them and say yes. No like here's our here's our list for this release But once you have that in place right then all the consumers of that can start to If it lives up in the upstream or if it's something you have to inject in your system I think there's a lot of work to be done here, but at the same time What's what's start to get it to a point to where it can be aggregated and really for thinking about The personas like the one aos are authorizing officials In in what information they need but also the operators Like they're the ones building these environments So the ones that are going to have to change things on the fly and or you know light largely React to something that is no longer compliant and fix it and so like I see multiple layers here of having the the document the universe controls available Starting to build out your environments or update and maintain your environments and ingesting the results of that those compliance checks And making them available and visualization Um Kind of some other things involved there with your question. I'm probably not hinting at right away, but Absolutely relevant All right, we have time for one more question Okay, we'll go here Hey, good afternoon. Um, I'm thinking about the Relationship with the compliance department. How did you guys streamline that relationship? So that they trusted that your policies satisfied their phone books full of rules It's a valid question. Um, I I would not make the claim that it is 100 validated by whoever sure is going to be doing this, right? And we're talking about tools such as lula. They're they're not tied to a hundred fifty three They're meant to be agnostic of the standards that we can you know do other things like socks and PCI etc and Given that There's still a large amount of work that still has to be done here and a large amount of validation that still has to occur And I think what's going to play hand in hand here with concepts We're well versed in or becoming well versed in is kind of like supply chain security and The idea of like provenance and attestation Absolutely applies here and getting things like having auditors signing policy having auditors sign You know compliance definitions for when something is met is Kind of a collaborative activity yet to take place. I'm hopeful that it can take place But we need automation tooling to kind of look at this compliance space And you know start to work with one another to build out something that Somebody would want to put their signature and stamp on. Yeah, I don't think we're there yet. Okay But I think we can get there. Yeah, cool. Thank you and something else that's going to help is reliability Like knowing that when you say or claim not that it's going to alleviate auditors concerns If your environment is compliant that when somebody else checks independently that the two line up because one of the historical problems is We are compliant. We tell you that we're compliant. Look look at our tool It says we're compliant and they come in it's like all right. There's 40% deviation. No, you're not so That's one thing. The other thing is putting control back in the people's hands who need to have control And that's a that's a question of trust and some of the things that can help with that are tools like signing and validation Of a lot of different things so that they can have the control you can run it The results are consistent and everybody's on the same page All right, that is time. Thank you very much for attending and thank you


Now the photo government has declared Tuesday, October 19, 2021 as a public holiday. This is to mark this year's Ido Mollid celebration by Muslims in commemoration of the birth of the Prophet Muhammad. Minister of Interior, Mr. Ralph Arewishola, made the declaration on behalf of the photo government while admonishing all Nigerians to imbibe the spirit of love, patience and perseverance which are able to guarantee peace and security in the country. Hello, hope you enjoyed the news. Please do subscribe to our YouTube channel and don't forget to hit the notification button so you get notified about fresh news updates.