Day 1 · R3 Deep Tech

Deep-dive talks spanning open-source large language models, multimodal image generation, AI-driven chip design, sovereign multimodal models, and AI security — governance and attacks alike.

Day 1 · Fri 27 Sep 2024Room R3 — Academic Activity Center 2F13:00–17:00Chuang Kun-ta (莊坤達), Associate Professor, National Cheng Kung University

At a glance

SpeakerTalkIn one sentence
Chen Yi-chang (陳宜昌), Senior Technology Manager, MediaTek ResearchBreeze 2.0: An Open-source Traditional Chinese LLMThe open-source Breeze family is expanding toward 'developer-oriented' features such as Function Calling, Vision, and Taiwanese-accented TTS, and releasing a Traditional Chinese Function Calling benchmark and model.
Wu Chen-ho (吳振和), VP, cacaFly Cloud AI+ CenterImplementing RAG in Multimodal Architectures for Image GenerationBreaks down the prompt dimensions and pain points of text-to-image generation, using jointly trained image-text embeddings and RAG to complete prompts, moving toward a 'chant-free AI' ideal.
Huang Yen-hsiang (黃彥翔), Director of Application Engineering, CadenceIntelligent System Design for Optimized IC DesignCadence uses reinforcement learning (Cerebrus) and generative AI (Voltus InsightAI) to automate PPA optimization and IR Drop debugging in IC design, compressing iterations that used to take weeks down to 1–2 runs.
Huang Han-hsuan (黃瀚萱), Associate Research Fellow, Institute of Information Science, Academia Sinica / Advisor, TAIDE Model Foundry GroupThe Development of Multimodal TAIDE ModelsTAIDE trains its sovereign LLM using only legally licensed data, aiming in 2024 to expand from text-only to multimodal, but usable Taiwan-related image data is extremely scarce (only about 1,300 images on Wikipedia).
Chiu Ming-chang (邱銘彰), Advisor, Taiwan Hackers Association / Co-founder, CyCraftThe Hidden Art Behind Successful AI ProjectsUses complex systems science (Double Descent, Spectral Bias, Condensation) to explain why DNNs generalize, and summarizes common feature-design and inductive-bias pitfalls in security AI projects.
Weng Hao-cheng (翁浩正), CEO, DEVCOREThe Evolution of Cybersecurity Attacks in the GenAI EraSurveys GenAI's impact on social engineering, phishing, and penetration-testing toolchains from a red-team perspective: it excels at learning and assistance, but the precision of a 'one-shot kill' penetration and zero-day discovery still can't replace human creativity.
Cha Shih-chao (查士朝), Professor, Department of Information Management, National Taiwan University of Science and Technology / Director, Research and Education Center for Cyber SecurityAI and Security GovernanceDistinguishes security management from security governance, demonstrating how GenAI can help compile management review meeting materials, risk assessments, and policy drafts, while stressing that confidentiality leakage and accuracy remain two major challenges.

Talks

7 of 7 talks

1Breeze 2.0: An Open-source Traditional Chinese LLMChen Yi-chang (陳宜昌), Senior Technology Manager, MediaTek Research (goes by 'YC')

MediaTek Research is advancing the Breeze series from 'speaking Chinese' to a developer-oriented model that 'uses tools, reads charts, and speaks with a Taiwanese accent.'

Key points

  • MediaTek Research is MediaTek Group's AI research institute, with locations in Cambridge and London, UK, and in Taiwan (National Taiwan University). In its 5 years of existence it has published 59 academic papers, and its open-source models have accumulated over 100,000 downloads in the past year.
  • The Breeze family: Breeze-7B and Breeze-8x7B (MoE) were among the first open-source Traditional Chinese large language models and Traditional Chinese benchmarks in Taiwan (and arguably worldwide). Training data exceeded 500GB (using 'Taipei ONE' (台北 ONE) computing resources), and Breeze-8x7B achieved scores on par with GPT-3.5 on Chinese-language performance.
  • GFD (Generative Fusion Decoder, described by the speaker as a shallow fusion technique): combines a speech recognition model with an LLM, using a 'scenario prompt' to make ASR more accurate for specific domains (e.g., customer service, financial terminology). Verified as a genuine MediaTek Research result — the paper is 'Let's Fuse Step by Step' (arXiv:2405.14259) — it fuses an LLM directly with ASR/OCR models at inference time without retraining.
  • Breeze 2.0's focus is on 'developer-oriented' features across three areas: the language model (RAG, Long Context, Function Calling, Vision/Chart), speech recognition (GFD), and speech synthesis (TTS). Demo scenarios include call centers (speech-to-text + intent detection + Function Calling connected to backend systems) and enterprise knowledge management (reading charts in financial reports/compliance reports + Function Calling to query internal data).
  • Function Calling technical details: during training, a `tools` role describing available functions is introduced before the assistant's turn, along with a special token that performs 'relevance classification first' (deciding whether a tool should be used at all before deciding whether to generate call parameters). The speaker said this approach is one he 'hasn't seen in prior papers,' and it makes subsequent generation more stable.
  • Function Calling is divided into 5 categories by number of functions/call counts: simple, multiple, parallel, parallel multiple, and irrelevant (no function needed at all) — corresponding to the internationally known Berkeley Function-Calling Leaderboard (BFCL) evaluation framework (which includes three scoring methods: AST comparison, actual API execution result comparison, and irrelevance testing).
  • The team translated, corrected, and localized BFCL, releasing a Traditional Chinese version of the Function Calling benchmark and open-sourcing the Breeze-7B Function Calling model. Among models that can both 'chat and do Function Calling,' it outperforms comparable models (including Berkeley's own Gorilla model) on the Traditional Chinese benchmark and beats GPT-3.5, though its chat ability is slightly degraded compared to the previous generation of Breeze.
  • Explanation of Pretraining/Post-training concepts: pretraining uses next-token prediction to compress semantic and reasoning ability out of massive corpora (e.g., Llama 3 used 75TB of English data); post-training applies a conversation template to teach the model to become a chatbot. Function Calling training uses the same template logic, just with an added `tools` role and special token.
  • Vision/Chart understanding: the team is building a locally-grounded Taiwan chart-understanding benchmark, covering exam questions (math/history questions with figures), business flowcharts/infographics, relationship diagrams, everyday-life scenarios, and mobile UI understanding, to be released soon.
  • TTS demo: a TTS system with the internal codename 'UHINA' fully synthesized the voice of AI YouTuber Li Hung-yi (李鴻毅) to produce an advertisement (he did not actually record it himself — only his voice usage was licensed), highlighting a highly natural Taiwanese accent and voice cloning requiring only about 10 seconds of recording. The technical pipeline is: text → Zhuyin (converted using the team's own polyphone-disambiguation model) → Speech Token LM → vocoder (flow matching/diffusion model) → Mel spectrogram → speech. Verified: the corresponding publicly released open-source project is BreezyVoice (arXiv:2501.17790, a MediaTek Research × National Taiwan University collaboration), which uses the CosyVoice architecture, S3 tokenizer + LLM + OT-CFM (optimal-transport conditional flow matching) + Zhuyin input for polyphone disambiguation — matching the speaker's description of the pipeline. The internal codename 'UHINA' may be a project nickname; the public name is BreezyVoice.

Tech, products & figures

Breeze-7B / Breeze-8x7B (MoE)
MediaTek Research's open-source Traditional Chinese foundation models; Breeze-8x7B achieves GPT-3.5-level performance in Chinese.
Breeze-7B-FC (Function Calling version)
Open-sourced; leads comparable Function Calling-capable models on the team's own Traditional Chinese BFCL benchmark.
Generative Fusion Decoder (GFD)
A training-free shallow fusion framework combining LLMs with ASR/OCR models.
BreezyVoice
Taiwanese-accented TTS capable of 10-second voice cloning, built on CosyVoice plus Zhuyin-based disambiguation.
Berkeley Function-Calling Leaderboard (BFCL)
The Function Calling evaluation standard; the Breeze team translated it into a Traditional Chinese version and open-sourced the benchmark.
Breeze 2 Herd of Models (3B/8B, with Vision + Function Calling)
The paper (arXiv:2501.13921) was only formally published in January 2025, after this talk — this talk was a preview ahead of that publication.

Notable quotes

For us researchers, a language model is really just an excellent description of a semantic space... it's like a complete map of the semantic space, a map of extremely high precision.

Q&A

  • No Q&A (the moderator moved directly into the next session, with no interactive question segment).

Fact-check notes

  • The speaker's name, company, and title all match the official agenda (Chen Yi-chang / MediaTek Research / Senior Technology Manager); no correction needed.
  • GFD, BreezyVoice, Breeze-7B-FC, the Traditional Chinese BFCL, and others all have corresponding public papers/model pages that can be found, and their content matches the talk's description.Sources：The Breeze 2 Herd of Models
  • No public data could be found corresponding to the TTS internal codename 'UHINA'; the publicly released name should be BreezyVoice (it could not be confirmed with 100% certainty whether the two are different names for the same system).
2Implementing RAG in Multimodal Architectures for Image GenerationWu Chen-ho (吳振和), VP, cacaFly Cloud AI+ Center

Breaks down the prompt dimensions and common pain points of text-to-image generation, arguing for jointly trained image-text embeddings and RAG to complete prompts, moving toward the goal of a 'chant-free AI.'

Key points

  • The topic is positioned around Text-to-Image: the core problem is how to use precise prompts to generate the images users expect.
  • Solution path: use Auto Prompt to perform multiple rounds of recursive optimization, gradually converging on the ideal result.
  • An industry pain point highlighted: generated results often 'feel too AI,' lacking naturalness and failing to match brand tone.
  • Breakdown of prompt dimensions: style, concept, color tone, location, background, style references, camera, lighting conditions, time, scene staging, characters, character details, and lighting details.
  • Technical pipeline (jointly trained image-text embedding): train an embedding jointly using images + text → feed in image and text features together → convert to a text vector → combine the prompt with relevant data retrieved via RAG to form a new prompt → feed into an image generation model to produce the image.
  • Closing vision: the goal is to 'achieve the realm of chant-free AI' — borrowing a gaming term (having to recite a lengthy incantation before casting a spell) — meaning that in the future, users won't need to painstakingly craft lengthy prompts for AI to generate the image they want.

Tech, products & figures

Auto Prompt
A method that generates prompts through multiple rounds of recursive optimization.
Jointly trained image-text embedding
A technical approach that feeds image and text features in together and converts them into a text vector.
RAG (Retrieval-Augmented Generation)
Supplements prompt generation with externally retrieved relevant data, improving the consistency and controllability of generated images.

Notable quotes

Achieve the realm of chant-free AI.

Q&A

  • No Q&A

Fact-check notes

  • Wu Chen-ho (English name CH Wu) currently serves as Deputy General Manager of cacaFly's 'Cloud AI+ Center,' matching the official agenda's title of 'cacaFly Cloud AI+ Center, VP.'
  • In 2022, cacaFly partnered with Google Cloud to establish the 'Cloud AI+ Center,' positioned as a digital transformation consultancy combining marketing technology experience with cloud service capability. It has obtained Google Cloud Premier Partner status (2022), Infrastructure Specialization certification (January 2023), and the Partner All-Stars award (won consecutively in 2023 and 2024).Sources：cacaFly Cloud AI+ 雲端智能中心｜關於我們
  • 'Using RAG for image generation' was a relatively rare, newer technical combination in 2024: RAG was originally designed for text-based LLMs — retrieving relevant data from an external database first, then adding it to the prompt to make output more accurate. 'Multimodal RAG' extends this logic to the image/video domain, retrieving reference images that match a specific character's appearance, product details, or brand visual style first, thereby solving common issues in text-only generative AI such as 'poor character consistency' and 'unstable style.' This matches the technical pipeline described by the speaker.Sources：IBM：What is Multimodal RAG?
  • Wu Chen-ho also gave a talk on a similar topic, 'Multimodal and RAG-Powered Brand Generation Strategy,' at another 'Generative AI Conference' in 2025, showing that this is a subject area he continues to develop and share publicly (the details of that talk differ from this one and should not be taken to represent this talk's content).Sources：cacaFly 官網
3Intelligent System Design for Optimized IC DesignHuang Yen-hsiang (黃彥翔), Director of Application Engineering, Cadence

Cadence uses reinforcement learning and generative AI to automate the entire IC design flow from PPA optimization to IR Drop debugging, compressing weeks of work into 1–2 iterations.

Key points

  • Cadence is an IC design software (EDA, Electronic Design Automation) company, positioned 'upstream of wafer fabrication (e.g., TSMC)': every AI chip design must pass through tools like Cadence's before it can become an actual circuit layout.
  • AI's main battleground in IC design is optimizing the mutual trade-offs among PPA (Power/Performance/Area), as well as recent challenges from the rise of advanced packaging: 3DIC (e.g., NVIDIA's GH200 uses an interposer to connect two large dies, where interposer speed directly affects AI compute), the slow (10–20 years of experience) cultivation of high-frequency analog/RF (5G/6G) design talent, integration of multiple IPs (CPU/GPU/NPU), and near-100% functional verification requirements for safety-critical chips (e.g., automotive ADAS).
  • Cadence Cerebrus: a reinforcement-learning-based PPA optimization engine. The speaker likened it to AlphaGo but stressed 'the difference is it can backtrack' — after exploring a set of design parameters, if the result is poor it can automatically roll back a few steps and retry, replacing the old manual process of a single 2–3 day run that had to be rerun on failure. The resulting machine learning model lets subsequent similar designs 'converge in one or two runs' — in one example, a senior engineer used AI to push a chip's achievable clock frequency from a manually-tuned 3.41GHz to 3.72GHz. Verified: Cadence Cerebrus is a real product, officially described as 'machine-learning-driven, full-flow RTL-to-GDS automated optimization that replaces manual tuning with a reinforcement learning engine, improving engineering productivity by up to 10x and PPA by up to 20%,' matching the talk's content.
  • Cadence Voltus InsightAI: uses AI to identify the 'culprit' behind IR Drop (voltage drop) issues (nearby components with abnormal current draw), then automatically decides to widen/add PDN (power delivery network) traces to fix it — in one example, this reduced a design's violation count from tens of thousands down to roughly 700–1,000. Verified as a real Cadence product, officially positioned as 'the industry's first generative AI technology that can automatically identify EM-IR violation root causes and automatically implement fixes, correcting up to 95% of violations before signoff.'
  • Other AI applications mentioned: a joint-optimization engine for multi-physics analysis (simultaneously analyzing SI signal integrity / PI power integrity / thermal); a Data Center Digital Twin (using AI to control server-room fan/cooling scheduling to save power); and Cadence's acquisition of biotech companies to apply EDA algorithms — found to be highly similar to biotech algorithms — to accelerate drug/vaccine development.
  • Summary: Cadence offers a complete AI-assisted EDA solution spanning digital IC PPA optimization, analog/RF circuit implementation, 3DIC multi-physics analysis, digital functional verification, and PCB layout.

Tech, products & figures

Cadence Cerebrus
A reinforcement-learning-driven RTL-to-GDS PPA optimization engine.
Cadence Voltus InsightAI
A generative-AI-driven tool for IR Drop root-cause analysis and automatic correction.
NVIDIA GH200
Used as an example to illustrate the importance of 3DIC/interposers/HBM to AI compute.

Notable quotes

Your chip can run a bit slow, your chip can consume a bit more power, but your chip absolutely must not break because of an error.

Q&A

  • No Q&A.
4The Development of Multimodal TAIDE ModelsHuang Han-hsuan (黃瀚萱), Associate Research Fellow, Institute of Information Science, Academia Sinica

TAIDE insists on training its sovereign LLM using only legally licensed data, aiming in 2024 to extend from text-only to multimodal — but the extreme scarcity of Taiwan-related image data is the biggest bottleneck.

Key points

  • TAIDE is a project driven by the National Science and Technology Council (NSTC), aiming to build a sovereign large language model with Taiwanese knowledge and values, and to compete on par with international models (Llama 3.1/3.2, Mistral, Phi-3.5, Gemma 2, etc.).
  • The biggest difference from international models: TAIDE trains only on legally licensed data, unlike most international models that directly scrape common-crawl web data (including PTT, Dcard, blog posts, etc.). This makes data acquisition much harder and leaves the model less familiar with subculture/internet-forum slang.
  • The speaker stressed that 'making a model that only outputs Traditional Chinese' has no real technical merit in itself (you could even just swap the entire vocabulary to Traditional characters without training). What TAIDE really needs to achieve is: understanding local Taiwanese usage (e.g., '土豆' [tudou] mostly means peanut in Taiwan, not potato), familiarity with Taiwanese knowledge, and grasping the Taiwanese values of diversity, inclusion, and respect for the individual — then implementing these values during the alignment stage.
  • Timeline: 2023 was spent on data collection and building the team/training infrastructure; a Llama-3-based TAIDE version was released in April 2024 (already seeing considerable usage); the goal for the second half of 2024 is to advance to multimodal (at minimum, able to understand images), focusing on scenarios like Taiwanese temple festival activities and flora/fauna recognition.
  • Technical route: starting from an existing backbone model, first add Chinese phonology-related capability, then further extend to a vision LM (vision-language model).
  • Architecture: currently uses an LLaVA-like 'late fusion' architecture — after an Image Encoder extracts features from the image, a Projector projects them into the existing LLM's semantic space (equivalent to appending roughly 500–600 visual embeddings after the text embeddings). The drawback of this architecture is that the feature-extraction stage 'cannot see' the textual requirement (e.g., wanting to look only at the lower-left corner of an X-ray, yet features are still extracted from the whole image). This is why the industry is seeing the rise of 'early fusion' (e.g., Meta's Chameleon architecture), which fuses vision and text starting from the feature-extraction stage. But early fusion requires training from scratch, with data and compute demands far beyond TAIDE's current scale, so TAIDE still uses the late-fusion architecture, which can leverage existing large models plus existing vision models at lower training cost.
  • Training is divided into three stages (similar to text-only LLMs): Pretraining (image captioning, learning image-text correspondence), Instruction Tuning (teaching the model to answer various visual questions, such as OCR, object recognition, event judgment), and Alignment.
  • An important nuance in caption data design: if source data (e.g., from the Ministry of Culture/Wikipedia) is overly rich in description (e.g., even including the history of salt-drying), the model will learn knowledge 'beyond the image,' training in worse hallucination. Captions therefore need to be filtered to keep only concrete descriptions that 'can be stated just by looking at the picture.'
  • The real-world difficulty of data acquisition: only about 1,300 Taiwan-related, CC-licensed images exist on Wikipedia — far from enough. Requesting data from government agencies (e.g., the Tourism Bureau) is often met with 'go scrape it yourself,' and many Tourism Bureau photos don't actually have their copyright held by the bureau, making them unusable. The Ministry of Culture's cultural memory bank has usable data but it's narrow in scope (mostly cultural artifact archives). This month the team just obtained roughly 700,000 flora/fauna photos from Academia Sinica's Center for Digital Cultures' 'Encyclopedia of Life Taiwan' (still being processed, not yet used in these results). LLaVA's original (English) training data was also translated into Traditional Chinese, but its image content is unrelated to Taiwan, so it can only be used for basic training.
  • Evaluation method: international Visual QA datasets are irrelevant to Taiwan, so the team built its own local test set — recruiting volunteers to photograph scenic spots/food/transportation/culture/daily life/celebrities and giving up copyright, then designing three difficulty tiers: (1) pure visual recognition (e.g., counting the number of scooters parked under an arcade), (2) visual features + world knowledge combined (e.g., identifying whether a Taiwanese fish species is poisonous or edible — the speaker cautioned 'the answer isn't guaranteed to be correct, don't actually go eat it'), and (3) complex image reasoning (e.g., reading an MRT route map to plan a transfer).
  • Concrete exam question demos: train ticket OCR (must recognize simplified/traditional or font variants of '台' to pick the right answer: Taipei → Tainan) plus an extended-knowledge question (whether the Taipei-to-Tainan route passes through Keelung, which requires extra railway geography knowledge); and temple idol recognition (which side of Mazu the god Qianliyan stands on). The speaker specifically noted that GPT-4o got both questions right, expressing surprise and being 'disheartened' by how fast international models are absorbing Taiwanese knowledge.
  • Challenges and reflections: the volume of legally licensed Taiwanese data falls far short of what's needed to compete with international models; every new base model (Gemma 2 → Llama 3.1 → Llama 3.2) requires re-tuning the entire hyperparameter set (epochs, batch size, context length, data ordering) — it's not a matter of 'shipping a new version in a week'; hallucination in multimodal tasks is worse than in text-only tasks (e.g., misidentifying a country's leader from its flag), requiring extra safety safeguards; the strategy is therefore to concentrate resources on niche areas that big international vendors and private companies 'have no incentive to invest in.'
  • Current/upcoming releases: a Llama-3-based fine-tuned 70B model has been completed (outperforming the original Llama 3 70B on Traditional Chinese); 8B and 70B versions based on Llama 3.1 are being trained; and the team is evaluating whether Llama 3.2, released just the day before, is suitable as the base for the next version.

Tech, products & figures

TAIDE
A Taiwan sovereign large language model project driven by the National Science and Technology Council (NSTC), trained only on legally licensed data.
LLaVA architecture
The 'late fusion' vision-language architecture template currently adopted by the TAIDE multimodal model.
Meta Chameleon
A contrasting example of an 'early fusion' architecture.
Encyclopedia of Life Taiwan (Academia Sinica Center for Digital Cultures)
A dataset of roughly 700,000 flora/fauna photos, just obtained and still being organized.
GPT-4o
Used as a comparison to test Taiwan-specific knowledge questions (train routes, temple idols), and got all of them right.

Notable quotes

In the Taiwanese context, '土豆' [tudou] mostly refers to peanut — only in specific contexts, like the dish 'liangban tudousi' [cold shredded potato salad], would you know it means potato... this kind of thing is something only within Taiwan's local 'namespace' would you understand.

Q&A

  • No Q&A.

Fact-check notes

  • The speaker's name, affiliation, and title match the official agenda (Huang Han-hsuan / Academia Sinica / Associate Research Fellow). Verified via web search, Huang Han-hsuan also serves as an advisor to TAIDE's 'Model Foundry Group,' consistent with the talk's content (TAIDE's technical planning).Sources：iThome 報導
  • Found that the TAIDE project had previously released Llama-2-based TAIDE-LX-7B/13B; this talk mentions that from April 2024 it switched to releasing new versions based on Llama 3, which is consistent in timeline with the project's evolution (an official announcement text specifically confirming that a fine-tuned Llama3-70B version had been released as of September 2024 could not be found to cross-check line by line, but the direction matches what the speaker described).
5The Hidden Art Behind Successful AI ProjectsChiu Ming-chang (邱銘彰), Advisor, Taiwan Hackers Association; Co-founder, CyCraft (奧義智慧) — the talk draws heavily on his company's research

Draws on complex systems science to explain why deep learning generalizes, and summarizes common feature-design and algorithmic-bias pitfalls in security AI projects.

Key points

  • Opened by mentioning that a paper from the CyCraft research team was accepted into the EMNLP 2024 main track (the speaker mentioned collaborating with a professor from National Yang Ming Chiao Tung University; the collaborator's full name and the specific paper could not be verified — unverified).
  • Demonstrated the company's LINE cybersecurity news bot (RAG architecture): it crawls 5 Taiwanese news sites to compile security news and only answers news-related questions (deliberately unable to chat casually). He stressed that AI applications in cybersecurity must 'say I-don't-know when they don't know, and must attach a reference,' because general-purpose models like ChatGPT sometimes fabricate CVE numbers that don't exist at all. This bot was also specially fine-tuned so it never outputs Simplified Chinese characters or Mainland Chinese phrasing.
  • Main theoretical section (the speaker explicitly stated that 'some of this is my own hypothesis, not full consensus'):
    • Used the analogy of the Wright brothers building an airplane in 1903, yet humanity only truly clarified the principle of lift at a 2003 NASA symposium (it's the Coandă effect, not the common misconception of Bernoulli's principle): 'you can build something useful without understanding the underlying principle, but understanding the principle helps define its boundaries of use and safety margins.'
    • Criticized the industry for using jargon like 'Emergence,' 'Scaling Law,' and 'Black Box' to dodge the question of 'why does AI work this way'; argued that the computation itself is not mysterious (matrix addition/subtraction/multiplication/division + backpropagation) — what's truly unpredictable is the trained model's behavior.
    • The Double Descent phenomenon: traditional statistics (VC dimension theory) predicts that as models grow larger, testing error should rise (overfitting), but papers from OpenAI and others in 2017–2018 found that once model size, data volume, and training epochs increase past a certain point, testing error actually decreases again, indicating that generalization has emerged.
    • Spectral Bias / F-Principle: when training, DNNs prioritize fitting macroscopic, low-frequency features first, and only fit microscopic, high-frequency features later (shallow networks fit low frequencies preferentially, while deep networks are needed to fit high frequencies).
    • The Condensation phenomenon: during training, neighboring neurons converge toward the same vector and fire together; this phenomenon is the theoretical basis for why Network Pruning works (one neuron can represent a group of synchronously firing neurons).
    • Extends into a physical intuition for Early Stopping: a real data signal is strong at low-to-mid frequencies but gets masked by high-frequency noise (similar to 1/f noise superimposed with white noise); if the model trains too long, it will even memorize the noise (over-training), so training needs to stop early.
    • Wrapped up using complex-systems-science vocabulary: Emergence (macroscopic relationships cannot be reduced to microscopic components), Self-organization (neurons self-organize into structures that work together) — using the metaphor 'there's no love between atoms, but there's love between people' to illustrate that macroscopic phenomena cannot be explained by reductionism.
  • Practical takeaways on 'how AI projects succeed' (returning to the talk's title):
    • Key point one: if the feature design is wrong, no amount of downstream learning power will help. Example: if ransomware detection is built on just one rule — 'calls the API that deletes system backups' — it will misjudge legitimate backup tools (like BitLocker); as whitelist rules keep getting added to eliminate false positives, you eventually find 'the whitelist carries far more information than the blacklist,' and the project has quietly shifted from classification to anomaly detection. The problem often lies in ignoring relationships between objects, between objects and space-time, and even 'relationships between relationships' (e.g., two malicious files with similar style may share the same author; two hosts frequently appearing together in the same attack may belong to the same infrastructure; two security incidents with the same attack technique may be the same APT group) — these relationships are themselves important features.
    • Mentioned dataset shift: the distribution centroid of lab data, the boss's computer data, and customer field data shifts as data scale changes, so if-else rules tuned in the lab often fail in the field — models need to be able to keep adapting.
    • Key point two: you must understand the inductive bias and applicable boundaries of the algorithm/model you're using. Example: using k-means to cluster old and new malware samples to find 'novel malware' will misgroup samples because k-means assumes each cluster has a similar (size-based) number of members — the correct approach should use density-based clustering instead. Also cited the No Free Lunch theorem (mathematically proven in 1996–97, not just a metaphor for 'there's no such thing as a free lunch'): for any model, you can find some dataset on which it performs poorly, meaning every model has a limited range of applicability.
  • Closing analogy: a 500-horsepower sports car vs. 500 real horses — horses were not replaced by cars; instead they became a luxury good for the wealthy (a single horse can cost over a hundred million NTD), implying there's no need to obsess over 'will AI replace me' — the real question is how to become a 'person of taste' who cannot be replaced by tools.

Tech, products & figures

CyCraft LINE Cybersecurity News Bot
RAG architecture, only answers news-related questions, attaches references, and avoids Simplified Chinese phrasing.
Double Descent phenomenon
A deep-learning generalization phenomenon proposed in related OpenAI papers from 2017–2018.
Spectral Bias / F-Principle, Condensation
Complex-systems-science concepts explaining DNN feature-learning preferences and the theoretical basis of network pruning.
No Free Lunch theorem (1996–97)
A mathematical theorem establishing that every model has boundaries to its applicability.
k-means vs. density-based clustering
A common pitfall example in algorithm selection for clustering in security anomaly detection.

Notable quotes

You thought you were going to write a blacklist, but bit by bit you end up organizing a whitelist for the client; you thought you were doing classification, but you're actually doing anomaly detection.
I have a 500-horsepower supercar, and I have 500 real horses — which is cooler? Of course the horses are cooler. If I already have horses, why would I need a car?

Q&A

  • No Q&A (the speaker mentioned the content ran long and borrowed about 5 minutes from the next speaker, moving directly into the next session).

Fact-check notes

  • Chiu Ming-chang was verified to be a co-founder of CyCraft (co-founded with Wu Ming-wei and Tsung Pei-kan), and is also active in the Taiwan Hackers Association, consistent with the agenda's listed identity of 'Advisor, Taiwan Hackers Association' and the talk's description of drawing on 'his own company's research.'Sources：CyCraft 官網
  • The collaborator's name for the 'EMNLP 2024 main track' paper could not be verified (there are multiple scholars with similar names in the IC/NLP field, so the specific individual could not be confirmed — unverified).
  • Double Descent, Spectral Bias/F-Principle, Condensation, and the No Free Lunch theorem are all published research directions in deep learning theory with consensus support, and are consistent with the speaker's core conclusions (the speaker himself also stressed that some extended inferences are his personal hypotheses, not rigorously footnoted one by one, so this note did not cross-check every specific paper version he cited verbally).
6The Evolution of Cybersecurity Attacks in the GenAI EraWeng Hao-cheng (翁浩正), CEO, DEVCORE (戴夫寇爾) — goes by Alan/Allen Own

From a red-team perspective, GenAI is currently a powerful copilot usable by both attackers and defenders, but the precision of a 'one-shot kill' penetration and zero-day discovery remain squarely the domain of human creativity.

Key points

  • DEVCORE is a Taiwanese offensive-security company (red-teaming, penetration testing) that has spent a decade tracking AI's impact on both attack and defense; Weng Hao-cheng jokingly called himself 'the only person in the room who doesn't understand AI,' sharing from a practical-application angle.
  • Cited a statistic from 'Duck Trash': social engineering attacks increased by roughly 135% since GenAI emerged (this vendor's name, original source, and exact figure could not be verified — unverified); also mentioned that Rapid7 observed extensive discussion of criminal AI applications on the dark web, even the emergence of complete 'AI scam kits' (tools plus services, all in one).
  • Observed real-world change: AI-generated targeted social engineering emails are now extremely fluent with almost no linguistic tells (the stiff, translated feel that used to be common has disappeared) — they can now mainly only be caught via IP or email-header tracing. But mass, scattershot phishing emails were already low-cost, so they don't need AI to improve.
  • Survey of attack surfaces AI can assist with: automatically generating malware/ransomware code (still fairly simple for now, not yet relied on by advanced hacker groups, but risk keeps rising); deepfake voice/video/photo impersonation; code analysis and assisted writing of attack scripts (similar to Copilot); 'jailbroken' GPT services like WormGPT, FraudGPT, and FreedomGPT that help bypass safety restrictions to produce phishing emails and even help work out the rules for generating personal data like national ID numbers or bank card numbers; also personally tested cloning his own voice to control voice-activated home appliances, confirming the feasibility of voiceprint-cloning attacks.
  • Survey of skills needed by red teamers: curiosity and desire to learn, creativity and cross-domain association, technical expertise, resilience under pressure, patience and care, teamwork, and professional ethics. The speaker believes AI already exceeds or matches humans in breadth of professional knowledge, pressure resilience (no psychological stress), and patience/care, but still has clear gaps in 'creativity/associative thinking (especially digging out a brand-new zero-day from scratch)' and 'professional ethical judgment' (AI may not, unlike a human, pause to ask and communicate first when a vulnerability might crash the target's system).
  • Red-team engagements are characterized by 'precision, prioritized risk control, stealth, establishing persistent connectivity, and reading the opponent's psychology' (for example, the 'feint' tactic: generating heavy traffic at point A to draw the blue team's attention while the actual objective is quietly completed at point B). The speaker believes AI's precision is currently insufficient to judge 'which vulnerability delivers a one-shot kill,' making this an area that will remain hard for AI to replace humans in, in the near term.
  • What AI is currently confirmed to be capable of: report writing, security operations/vulnerability management, social engineering exercise design, behavioral analysis, and automated penetration-testing assistance. What it still cannot do: higher-level strategic judgment and more creative attack techniques (especially zero-day discovery).
  • Specific tools/services mentioned: PastGen (name could not be verified — unverified; functionally similar to the public tool PassGAN, using someone's past passwords to guess future likely passwords, hence the recommendation to use fully random passwords plus a password manager); PentestGPT (not meant to replace red teamers, but a great learning tool that guides through penetration steps and suggests next steps based on tool output pasted in by the user, especially suited for beginners hesitant to keep bothering their mentor); BurpGPT (suggests directions worth testing further based on traffic correlations observed via Burp Suite, helping catch human blind spots); AutoPunk (tool name could not be verified — unverified; an automated reconnaissance tool that finds potentially exploitable spots in a target IP's open services); OSINT-type tools linked to leaked personal-data databases; also personally tested using AI to analyze source code to find simple vulnerabilities (like buffer/stack overflows); mentioned that the first-stage results of DARPA's AI Cyber Challenge (AICC) had just been announced, seeing it as a sign of great potential for the future of automated AI vulnerability discovery.
  • Revealed that many so-called 'jailbroken GPT tools' are, behind the scenes, actually just a collection of Hack The Box write-up PDFs turned into a RAG knowledge base (described as not technically sophisticated but practically very helpful); also personally tried to break out of GPT's own sandbox (not yet successful).
  • Across the full red-team attack chain (external reconnaissance → perimeter penetration → internal lateral movement → obtaining core sensitive data), AI's current state: it can help in the external intelligence-gathering/log-analysis stage (though attackers deliberately keep data volume low to avoid detection); it can help find patterns in enterprise default passwords during internal lateral movement; but truly penetrating into core systems still cannot currently rely on AI (it requires precision and staying undetected). By contrast, AI is more mature for defenders doing incident investigation/log analysis — the speaker shared that when helping NGOs/NPOs respond to security incidents, he feeds web logs (access logs, etc.) directly to AI, which can catch anomalous behavior that's hard for the human eye to spot (e.g., a misspelled user-agent string exposing automated traffic rather than a real user).
  • Called on enterprises to build frameworks and governance guidelines for making good use of AI to prevent things that shouldn't happen (echoing the governance theme of the next talk by Cha Shih-chao), and closed once more with the 'sports car vs. horse' metaphor, encouraging everyone to proactively think about what AI can help with.

Tech, products & figures

WormGPT / FraudGPT / FreedomGPT
Safety-restriction-removed 'jailbroken' GPT services that assist with criminal applications like phishing emails and personal-data computation.
PentestGPT
A learning aid for penetration testing that guides through testing steps.
BurpGPT
Suggests follow-up testing directions based on Burp Suite traffic analysis.
DARPA AI Cyber Challenge (AICC)
A competition for automated AI-driven software vulnerability discovery; first-stage results were just announced.

Notable quotes

I think what Burnman (Chiu Ming-chang) just said was really good — I think humans really need to keep on... AI right now is a great copilot; we absolutely need our own knowledge and our own ideas, and then use it to help us solve tasks.

Q&A

  • No Q&A.

Fact-check notes

  • The speaker's name, company, and title match the official agenda (Weng Hao-cheng / DEVCORE / CEO); verified that Weng Hao-cheng also serves as chairman of the Taiwan Hackers Association (HIT) and holds a master's degree in Information Management from National Taiwan University of Science and Technology, consistent with the context of his talk.Sources：iThome/DEVCORE 官網
  • No corresponding public data could be found for the 'Duck Trash' statistic source, the 'Apple AI five levels' framework, or the tool names 'PastGen' and 'AutoPunk' (functionally similar public tools include PassGAN and AutoPwn/AutoRecon, but the correspondence could not be confirmed) — marked as unverified rather than forcibly corrected to a specific tool name, to avoid misleading readers.
  • WormGPT, FraudGPT, PentestGPT, and BurpGPT are all widely reported, genuinely existing tools/services in the security community, and their described content matches known public information.
7AI and Security GovernanceCha Shih-chao (查士朝), Professor, Department of Information Management, National Taiwan University of Science and Technology / Director, Research and Education Center for Cyber Security

Security governance is strategic-level work; GenAI can help compile management review meeting materials, conduct risk assessments, and draft policy, but confidentiality leakage and output accuracy remain two unresolved challenges.

Key points

  • Opened by clarifying the difference between 'security management' (day-to-day operational level) and 'security governance' (strategic level: setting security strategy, defining acceptable risk, and connecting security to organizational goals), citing the ISO 27014 governance framework: a governing body oversees the organization's security posture, issues policy guidance after evaluation, and continuously communicates security status to stakeholders.
  • Reviewed the evolution of AI-related security regulation/governance issues: AI was first used for security anomaly/vulnerability detection → then attention shifted to training-data accuracy → the GDPR era required that automated decisions (including those made by machine learning) be disclosed and require user consent → the deep learning era added concerns about 'whether feeding data into a model leaks corporate secrets' → rising ethical concerns about 'AI causing external harm' gave rise to the EU AI Act and California's then-pending SB 1047 (a bill targeting the safety of frontier AI models; the speaker said a decision was expected on 9/30, joking that 'if it passes, it means no security means no AI'), including discussion of requiring AI systems to have a 'kill switch/emergency shutdown' mechanism.
  • Within the PDCA cycle of ISO 27001's ISMS, the common core across various ISO standards (9001/14001/27001, etc.) is actually clause 9.3, 'management review meetings': senior management oversees the security posture, assesses whether the management system needs improvement, and identifies improvement opportunities.
  • Four demo applications of GenAI in security governance practice (the speaker himself is researching this area):
    • Compiling management review meeting materials: previously required paying consultants a lot of money to manually compile audit reports, witness reports, and penetration test reports into presentations; now GenAI can help with summarizing, cross-period comparison, and generating preliminary recommendations. But the speaker cautioned that output tends to fall into generic, internet-template-style content — customizing it requires putting more confidential company details into the prompt, creating a trade-off between accuracy and the risk of confidentiality leakage. He also proposed using a self-hosted local model (sacrificing some accuracy to avoid data leaving the organization), arguing that governance scenarios don't necessarily need a 'creative' model — a faithful, not-too-clever local model that stably compiles existing structured data may actually be the more practical choice.
    • RAG retrieval of historical audit/incident records: organizing previously scattered, unstructured audit reports and incident records into a searchable, source-traceable knowledge base, so that senior management can rely on more trustworthy evidence for governance decisions at management review meetings, rather than fully depending on manual consultant compilation, which risks omissions.
    • Security trend analysis and report generation: GenAI can be asked to first draw basic charts along with the corresponding Python code, which is then manually refined. The speaker shared that this genuinely saves a lot of the time he used to spend writing his own code to produce reports.
    • Drafting policy/regulatory responses: for example, for new regulations like California's SB1047, prompt engineering can be used to have GenAI generate preliminary response recommendations; this likewise faces the same trade-off between degree of customization and confidentiality leakage.
  • A gripe about the current state of risk management: the traditional approach lists a huge inventory of assets and evaluates dozens of risk items for each one (e.g., 1,000 assets × 100 evaluation items = 100,000 entries per year), which in practice often becomes 'copying last year's numbers.' The speaker joked that this actually perfectly satisfies ISO 31000's requirement for 'consistency' in risk assessment (because it truly doesn't change a single word), but completely misses the original intent (accuracy/timeliness). He pointed out that Taiwanese companies generally have not built a 'loss database' (which can be inferred from the fact that almost every material-information disclosure says 'no material impact' — meaning nobody is actually seriously estimating losses). If a loss database could be built, GenAI could help interpolate from sparse historical data points to generate more complete risk-assessment curves, and support 'counterfactual analysis' (e.g., evaluating the ROSI return on investment of 'having bought a firewall' versus 'not having bought one').
  • AI can also help with generating questions for security education/training and producing simulated training data (the speaker joked it could be used for 'pop quizzes' to catch students off guard).
  • On organizational culture transformation: he argued that a truly 'proactive' security culture is one that anticipates and designs responses ahead of time, rather than reacting only after problems occur. AI can support this transformation in vulnerability handling/coaching work, but he candidly admitted there's no direct, necessary causal link between 'adopting AI' and 'organizational culture actually transforming.' He also mentioned that anomaly-detection mechanisms could be used to alert personnel experiencing 'security fatigue,' as a human-AI collaboration design rather than full replacement.
  • Closed with an economics supply-and-demand metaphor (drawing on content from his dual-degree program course with ASU, 'AI in Business'): if AI is a substitute for a given job, AI's improvement and falling cost will drive down that job's market price (used to explain the recent wave of programmer layoffs in Europe and the US). But governance/strategy work involving high-level human judgment is relatively harder to replace, because 'a boss usually doesn't lay themselves off' — in other words, strategic roles like security governance are structurally less threatened by AI replacement.

Tech, products & figures

ISO 27014
A security governance standard framework, defining the governing body's oversight/evaluate/direct/communicate cycle.
ISO 27001 clause 9.3, 'management review meeting'
The core setting for practical security governance work.
EU AI Act, California SB 1047
AI frontier-model safety/governance-related regulations mentioned in the talk.
ISO 31000
The risk management standard, used in the talk as a jab at how its consistency requirement gets misapplied as copy-and-paste.
Counterfactual analysis
Used to evaluate the ROSI return on security investments (such as a firewall).

Notable quotes

As managers, everyone need not worry — AI governance, or rather security governance, is hard to replace. Why? Because senior executives usually don't replace themselves.
Whenever I see that there's never been any material loss, I immediately think this unit definitely doesn't know how to calculate this stuff.

Q&A

  • No Q&A (after the talk ended, the moderator directly announced the end of the day's agenda).

Fact-check notes

  • Cha Shih-chao currently serves as Professor in the Department of Information Management at National Taiwan University of Science and Technology and Director of its Research and Education Center for Cyber Security; his research specialties include AI Security and Zero Trust Architecture, highly consistent with the official agenda's 'NTUST Professor' listing and the talk's topic.Sources：台科大資管系PanSci 專訪
  • The speaker mentioned that California's SB 1047 was 'expected to be decided on 9/30' — verified: California Governor Gavin Newsom actually vetoed SB 1047 on September 29, 2024 (two days after this talk, since Day 1 of this conference was September 27, 2024). At the time of the talk, the bill's outcome had not yet been announced, so the speaker's account was accurate as of the time of speaking; readers should note that the bill's final outcome was 'not passed,' so the premise of the speaker's on-stage joke ('if it passes, no security means no AI') did not come true.Sources：SF Standard 報導Wikipedia

中文版