mnemonic security podcast

The episode contains substantial, concrete insights about AI auditing practices at scale: specific governance frameworks (glass box models, prompt templating, shadow AI audits via proxy logs), real-world detection approaches (MCP traffic monitoring), and practical risk assessment methodologies. However, it contains moderate throat-clearing and repetitive thematic callbacks that dilute density.

“Did you analyze the data first? Did you look for anything that was a deviation from the normal set that you didn't want to train it on? Did you clean the data? All these columns that you put in here, are they relevant for what the model is going to do?”

“What you can do, of course, is that you can build a model when you train it on your own data and uh you basically start to use the model for your own data, you can build another model or build another system who's gonna uh test and ask questions for from it.”

Gaute's approach to auditing machine learning models from first principles - testing for hidden bias patterns, building explainability into production systems, and operationalizing governance through existing SDLC processes - is relatively fresh compared to generic AI governance talk. However, the core concepts (bias detection, data quality, governance integration) are not novel; the originality lies in execution details rather than contrarian frameworks.

“even though let's say that we can't discriminate on gender, even though if you don't put gender in it, we would still, with our data, have a possibility to separate gender from it. So it's basically finding these hidden patterns”

“they made the model to output to the customer service department or those who were uh going to talk to the customer, giving the I won't say the number of factors, but it's a uh set number of factors that contributed most to the decision.”

Gaute is exceptional for this dimension: he leads internal audit at Norway's largest insurer, reports directly to the board (not the CEO), and has hands-on experience auditing proprietary ML models in production at scale. He speaks from direct operational responsibility, not theory. His access to real data, real governance decisions, and real vendor relationships is rare and credible.

“He reports directly to the board. Not the CEO, just the board. Which means he can walk into any room in the company and ask uncomfortable questions.”

“Yes. So this is nothing new for you in that sense. Is that is that correctly understood? That's correct. And where we came from earlier is that the way we build something called tariffs is a mathematical model where we are trying to calculate the risks based on our data”

The episode includes specific technical implementations (glass box models, ServiceNow governance systems, proxy log analysis for shadow AI, MCP traffic detection) and named reference points (Dutch welfare case, Trump veterans model, Nordics insurer tech conferences). However, it lacks dollar figures, quantified impact metrics, or granular timeline details for most claims, relying instead on qualitative descriptions of processes.

“We found out that uh how much data is coming in, which is not that interesting, but we could see usage coming in, then but we were also looking at how much data is going out. And if you look at how much data going out, one prompt on text is very little data. Sending documents, you will see the difference.”

“What we've seen is that they're using it in HR. And now you're thinking, oh, that's the dangerous part. We're not using it in recruiting. Because that's the big no no that if you're using that to automatically hire people, then you're gonna fail. That's prohibited. But we use it for the personal handbook.”

The host asks competent clarifying questions (machine learning vs. foundation models, governance journey starting points) and allows Gaute extended space to elaborate. However, follow-up questions are infrequent and rarely challenge or probe deeper into tensions - the host largely validates and moves forward, missing opportunities to push back on assumptions or explore trade-offs in Gaute's positions.

“When you say machine learning model, that's not like something from OpenAI or Anthropic. You are auditing your own machine learning model. Can you clarify that a little bit?”

“Have you tried to audit one of the foundation models? I would say yes and no.”