← All IntelClip / OtherTwo pillars of verification: zero trust and multi-layered
From Guide, Verify, Solve — Anirban Chatterjee, Sonar · ≈9:16
“Zero trust in this context basically means that the code could really have come from anywhere.”
“Use a different methodology to review the code that was used to write the code.”
“You need to use computational review, you also need to use LLM driven review, and everything else in between, right?”
What’s in it
- Lays out a zero-trust framework for verifying AI-generated code
- Argues you should never use the same AI to write and check code
- Pushes for multi-layered review mixing computational and LLM-driven checks
Clip transcript
the AI-driven software development going forward. And so when we say verification, what do we mean, right? We think there's two core elements to successful automated verification when it comes to AI coding. One is that needs to be zero trust. What do we mean by that? Zero trust in this context basically means that the code could really have come from anywhere. It could still be written by a human, it could be written by an AI as I just showed you a few slides ago. Different AIs will write code in different ways, and you're not going to want to be able You're not going to want to use that same AI to to validate the code because you're going to want a diversity of of tools being used to make sure that you're catching all the different issues that can happen. And so, no matter where the code is coming from, you want to have a a similar comprehensive regime to verify that code that works the same no matter how that code was written, right? Use a different methodology to review the code that was used to write the code. Uh it's completely auditable, completely explainable, so you can prove that verification was run the same way every single time, and it's algorithmic and repeatable and consistent no matter how you run it. It also needs to be multi-layered. You need to have multiple ways uh a multiple techniques being used, multiple approaches being used to review the code that is being generated, right? Um because you're never going to be able to find every single problem that can occur in software by just using one or two methods. You need to use computational review, you also need to use LLM driven review, and everything else in between, right?
Comments
Sign in to comment.
Loading comments…