Beyond the AI Frenzy, the Decisive Battle May Lie in the "Invisible" Realm | A Conversation with Ant MPC Chairman Wei Tao: Privacy-Preserving Computation and Higher-Order Programming

Unlocking the value of data, without ever exposing it.

👦🏻 Podcast interview: Koji

🥷 Edited by: Bella

🧑‍🎨 Layout: NCon

The spotlight of the AI era shouldn't belong only to zero-to-one founders.

We've noticed an interesting phenomenon: compared to Silicon Valley executives who eagerly take the global stage, China's Big Tech leaders tend to keep a much lower profile.

Yet their platforms command vast resources, data, talent, and capital, and their decisions are actively shaping how the AI industry evolves.

That's exactly what Crossing wants to do — bring these frontline thinkers directly to you.

Last week, our conversation with Ant Group Vice President Xu Qing drew strong feedback; this week, we're joined by another heavyweight with legendary status: Tao Wei, Vice President and Chief Technology Security Officer at Ant Group, and Chairman of Ant Secret Computing.

Calling Tao Wei a "legendary geek" is no exaggeration. He was among the founders of MITBBS (未名空间), the spiritual homeland that influenced a generation of Chinese students abroad. He's also a committed open-source believer who describes himself as "growing up reading open-source code," and has dedicated himself to giving back to the community in his own way.

This conversation was sparked by the third anniversary of the open-source community "SecretFlow," and Tao Wei shared two areas with us that may not grab daily headlines but are critically important:

• Cryptographic Computing: A technology that enables data to be "usable but invisible," allowing data value to flow securely while protecting privacy — and feed more powerful AI.
• High-Order Program: A new engineering philosophy that builds reliability and control into every output through task decomposition and automatic verification.

At Crossing, we discuss models, applications, and infrastructure extensively. We're focusing on these two areas today because beneath the AI frenzy, they may well be the decisive factors in whether AI can truly industrialize and earn long-term trust.

This also points toward the next potential value high ground for AI entrepreneurs and investors: as model "intelligence" itself becomes increasingly commoditized, building trust and ensuring reliability through new technologies and methods may be the key to establishing real competitive moats and lasting value.

Listen on WeChat:

Listen on Xiaoyuzhou:

From MITBBS to Ant Secret Computing: Tao Wei's Technical Trajectory

👦🏻 Koji

Tao Wei, welcome. My first question is — you've been working for over twenty years, yet you don't seem worn down at all. How do you still have such youthful energy?

👦🏻 Tao Wei

Hello everyone, I'm Tao Wei.

Probably because I've always maintained curiosity about new technologies. Our generation has been fortunate — starting from when the internet came to China around 1993-1994. Peking University's physics department was the second in the country to get connected. Then came wave after wave of rapid technological iteration, bringing massive changes to society and daily life, with new things constantly emerging. I've been willing to embrace and experiment with them, so my mindset has stayed positive.

👦🏻 Koji

Of the new AI tools and products recently, which ones have genuinely surprised you?

👦🏻 Tao Wei

What's surprised me most lately is large models applied to programming. This wave of large models has been a huge shock to the industry. Previous AI, like AlphaGo, could only do one thing and still required massive human assistance. But this generation of large models is a true "general intelligence engine" — capable of many tasks. Some it does very well, others it makes elementary mistakes on, but overall it's becoming increasingly human-like.

So it's genuinely fascinating. I'm especially grateful for how technology has advanced, giving many people who can't code the chance to turn their ideas into actual programs. You've founded startups too — often the only missing piece was a programmer.

👦🏻 Koji

Everything's ready except the CTO.

👦🏻 Tao Wei

Today, if you have a small idea and can describe it, large models can really help you produce a complete app. The impact on the industry is enormous.

👦🏻 Koji

In our last episode, Xu Qing from Alibaba Cloud mentioned that the head of DAMO Academy has been using Cursor to write games — even built a Minesweeper.

👦🏻 Tao Wei

Many classic mini-games, large models write quite well now.

👦🏻 Koji

So have you started using AI to write your own small programs?

👦🏻 Tao Wei

Yes, I even wrote a small tool with it. When people share PowerPoint presentations, they often run into formatting chaos across different systems and versions. I really wanted a function that could lock the format in place. I basically described it in one sentence, had the AI convert it to an image and then embed it into a PPT, then import and generate code — and it worked completely.

👦🏻 Koji

Wow, it's 2025 and PPT formatting still breaks across different computers. So you built this tool for yourself?

👦🏻 Tao Wei

Later, many teammates and colleagues started using it too.

👦🏻 Koji

Sounds like something you could sell for $1.99. This used to be basically unsolvable, because you'd never find a product like this even if you searched.

👦🏻 Tao Wei

Actually people could code it themselves, but they didn't think it was worth the effort. Now it gets done incredibly fast.

👦🏻 Koji

Can you normally tell which parts of your colleagues' presentations were AI-written?

👦🏻 Tao Wei

How should I put it? I'm not too worried about this. Because the biggest problem with AI right now is that its viewpoints aren't professional enough; it can string together fancy language, but lacks genuinely effective, compelling arguments.

👦🏻 Koji

Insight matters.

👦🏻 Tao Wei

Right. The key to using large models today is having cognition that exceeds the model's. Once your cognition is in place, you can guide the large model to generate what you need. The core here is your own viewpoint — that's what the model cannot replace. This is fundamentally what an expert should do; previously, articulating these viewpoints in writing was exhausting. Now large models help express them well, but the direction still comes from humans.

Another thing: large model hallucinations are genuinely severe. People find that often they'll fabricate reference sources, or invent various industry policy documents — that can cause major problems. Without real-time verification, it's easy to fall into traps.

👦🏻 Koji

Before recording this episode, I was actually using ChatGPT to learn about your background, so I'm not sure how much of what I found was hallucination (laughs).

👦🏻 Tao Wei

Exactly. There's a famous saying that "large models are compression mechanisms." Compression is intelligence. But this formulation is overly simplistic. Essentially, you can compress the rules of many things, but this is lossy compression. Facts cannot be lossily compressed, because once you apply loss, facts develop deviations — that's the source of hallucinations.

When you feed massive amounts of material to a large model, it struggles to distinguish. Or rather, at extreme levels of compression, it's difficult to tell what's a rule versus what's a fact. And facts are often full of contingency. However correct the rules may be, once the facts are wrong, the reasoning fails too.

I think under the current transformer architecture, this problem is hard to solve. But humans are the same — rote memorization is extremely limited. What truly matters is grasping core ideas, while small deviations are unavoidable.

👦🏻 Koji

I recently came across an idea about why it's called "dream" — because only by daring to dream, even having some hallucinations, can people imagine and pursue bigger visions. So hallucinations are sometimes necessary too.

👦🏻 Tao Wei

You're absolutely right. Two famous "dreams" in human history: Mendeleev dreaming up the periodic table, and Kekulé dreaming of the benzene ring structure.

👦🏻 Koji

Those aren't just stories?

👦🏻 Tao Wei

No, both are factual. Truly remarkable.

👦🏻 Koji

Remarkable. I also want to ask about something interesting I read on ChatGPT about you — not sure if it's a large model hallucination. I heard that when you founded MITBBS, you did a lot of foundational work. Someone commented that you wrote the forum rules more carefully than love letters. Is that true?

👦🏻 Tao Wei

I think that's his hallucination. That wasn't me.

👦🏻 Koji

So you wrote love letters more carefully.

👦🏻 Tao Wei

Of course (laughs).

👦🏻 Koji

What was it like when you first started MITBBS? Could you share some stories from back then?

👦🏻 Tao Wei

I handled the earliest technical infrastructure for MITBBS. Later, since I was mainly based in China, I handed operations over to classmates in the US and gradually stepped back, only helping out with technical issues. The whole experience was quite interesting, and I'm proud of it. International students back then had an enormous surplus of energy and brainpower. There were lots of rules at first, but we quickly realized rules alone weren't enough — a lot of the time, you needed the community ecosystem to evolve healthily on its own.

👦🏻 Koji

Sounds like you need both rule of law and rule of virtue. Where the law can't reach, social norms and moral constraints have to step in to keep people self-disciplined. Back to the present — as Ant Group's Chief Technology Security Officer, do you find security work harder in the AI era? Have gray and black markets grown more powerful too?

👦🏻 Tao Wei

The challenges are definitely greater. Using technology for attack is usually simpler than defense. Black market technology is evolving rapidly today, whereas in the past their programming skills were quite poor.

👦🏻 Koji

Now there's Cursor.

👦🏻 Tao Wei

Right, not just Cursor. We used to catch black market operators who couldn't even write their own programs — they'd have to pay a few hundred yuan online to get someone else to write tools for them. Today they probably don't need that anymore, so the destructive potential is enormous.

There's something quite interesting in this process too. One of the earliest and most widely used Chinese programming languages was called "E-Language." Having a programming language created by Chinese should have been a source of pride, but unfortunately, roughly 95% or more of programs written in E-Language were black and gray market tools.

👦🏻 Koji

Because Chinese lowered the barrier to programming.

👦🏻 Tao Wei

Right, it's quite an awkward situation. It also reflects the stratification of the black market: the top-tier groups can really throw their weight around internationally. But there are also massive numbers of grassroots groups who can cause serious damage with very simple tools, and there are a lot of them. So the pressure we face fighting them every year is enormous.

👦🏻 Koji

You've been on the front lines of this offense-defense battle for decades now. Are there any moments that stand out vividly when you think back?

👦🏻 Tao Wei

I really started doing security work with Beijing's Olympic bid website. I began planning in 1999 and started building in 2000. On the day the bid succeeded in 2001, while people were celebrating with gongs and drums in the streets of Beijing, our team was upstairs watching the celebrations while guarding the Olympic bid website's security. Since then, the pressure of confrontation has only grown, but I've been fortunate to always have comrades-in-arms alongside me. Basically, the entire defense system has operated with zero incidents.

But there have been many arduous battles and missions. Over the years, Ant Group's security team has also assisted police in cracking down on numerous dark web black markets, including illegal data trafficking. The dark web is an anonymized network, so tracking black market activity there is very difficult. Basically, major cases require months of tracking and breakthroughs through collaboration across multiple companies.

👦🏻 Koji

I believe you understand the harm of black and gray markets better than most people, so I'm curious — how do you personally protect your privacy and data? Do you use different passwords for every website and bank?

👦🏻 Tao Wei

Actually, it's not that complicated. My most basic recommendation, and what I do myself: don't use your real name online (for things like shipping packages).

👦🏻 Koji

Ah, don't use your real name?

👦🏻 Tao Wei

Right. Because the core of black and gray markets is ID mapping — connecting data from different sources. Only once IDs are linked can criminals aggregate data from various parties onto you as a person. If you break that chain by using a pseudonym, it becomes very difficult for them to pinpoint information to you.

👦🏻 Koji

What about phone numbers?

👦🏻 Tao Wei

Actually, registering another phone number isn't difficult now, and because of number recycling, it already creates confusion for ID mapping. You don't even need to talk about black and gray markets — the carriers themselves are often a mess.

👦🏻 Koji

Right, I've noticed that too. For example, I have a consumer brand company, and we can't even get our own customers' phone numbers. The platforms probably can't either.

👦🏻 Tao Wei

Right. The government is now pushing for "pseudonymization" of real-name information. That means many websites and services won't necessarily need to directly store your real name and phone number in the future. This will break the ID mapping chains of black and gray markets and greatly increase their technical difficulty. For us consumers, this is the most cost-effective and efficient form of protection.

👦🏻 Koji

What about facial scanning and fingerprint recording? Many people are quite afraid of those. Do you resist them?

👦🏻 Tao Wei

Hmm, I'm actually fine with them. People's concerns are mainly about abuse. But facial recognition is actually the best technology for connecting online and offline — bar none — and there's a lot of demand for that connection.

In fact, once facial identity verification is properly implemented, it can elevate risk prevention to the highest level. At Alipay, we use facial recognition as the final backstop. The security capability of facial recognition is more than 30 times stronger than SMS.

👦🏻 Koji

That's a very high multiple, but what's the definition?

👦🏻 Tao Wei

It means the financial losses caused by SMS verification are much higher compared to facial recognition.

In the highest-risk scenarios, facial recognition can keep losses within one-thirtieth of what SMS allows — something no other single technology can achieve. Of course, in actual applications, we always use multiple factors combined, but when facial identity verification is truly implemented well, it's the most effective method. It's important to distinguish here: facial recognition only "recognizes who you are," while facial identity verification not only recognizes but also confirms that it's the "living, real you" in the moment. Many AI companies only stay at the facial recognition level and haven't reached the security assurance step.

And people's concerns are mainly about privacy abuse — for instance, faces being illegally used long-term without consent. But there are already many anti-abuse measures in trusted technology systems that can guarantee security and privacy. However, many experts may not fully understand this point and simply take a blanket approach of rejecting facial identity verification.

I think this is like "throwing the baby out with the bathwater" — it's quite a pity. Actually, facial identity verification can be designed to only be used in agreed-upon scenarios, providing the strongest security assurance while preventing privacy abuse — the two can be balanced.

👦🏻 Koji

Understood. I've recently seen some new models where just one photo paired with audio can generate a video. A few months ago it still looked fake, but now it's lifelike. I even saw a colleague make a video of me, and for a moment I thought it was really me speaking. But this still wouldn't pass facial identity verification, right?

👦🏻 Tao Wei

Right. Fooling the human eye isn't hard, but it can't fool computer analysis. Like when you watch movies — cars always accelerate when falling off cliffs, otherwise it wouldn't be exciting enough. It looks fine to the human eye, but if you examine it with a computer, it's full of flaws.

Current large-model-generated videos may seem realistic to human eyes, but under professional authentication technology, they have many vulnerabilities. They're still a long way from truly "perfectly realistic." The most famous example is finger detail errors, right? There are still many defects in the details that need improvement. Including the high-order program system I'm working on now, which can push large models to continuously become more refined.

Confidential Computing: Principles, Applications, and Globalization

👦🏻 Koji

You're also chairman of Ant Confidential Computing. Could you explain what confidential computing actually does? What does it have to do with ordinary people's lives?

👦🏻 Tao Wei

Confidential computing is actually "confidential state computing."

People may be familiar with general computing (CPU) and intelligent computing (GPU). The characteristic of confidential computing is: data remains in an encrypted state throughout its entire use. In the past, we assumed that to use data, you had to access it directly — but this meant data of tremendous value could easily leak or be abused. If it fell into hackers' hands, it would cause serious social harm. So how to protect data's value, prevent its leakage, while still letting it play a role across industries — this is a completely new proposition, and the best solution is confidential computing. The entire computing process is confidentially protected; data can only be computed and called upon in scenarios permitted by the data source party, and only the mutually agreed-upon results are output in plaintext for downstream use — this is confidential computing.

In other words, the entire computing chain proceeds under encryption protection — neither operations personnel nor developers can access the raw data. When plaintext is finally output, it's the data source party's encryption key that has the final say; only with their permission can results become plaintext. And throughout the process, whoever maintains the system or develops related applications cannot obtain plaintext data. This chain-wide protection capability is called confidential computing.

The biggest change confidential computing brings is: data processing appears more complex (since it's no longer plaintext), but in fact it can greatly accelerate industry adoption of data. Previously, when you handed data to a third party, the technical team's first instinct was to make a backup, and the business team's first thought was how to monetize it. The result was data prone to leakage and abuse, so data source parties became increasingly reluctant to share. This led to a widespread industry problem of data lacking processing, fusion, and verification, severely hindering value release.

Confidential computing solves this problem well, allowing data to be securely used while encrypted. It's like driving — people think safety measures like brakes slow you down. But without brakes, would you dare drive 120 km/h?

👦🏻 Koji

That's a very vivid metaphor — it's precisely because highways give us a sense of security that we dare drive fast.

👦🏻 Tao Wei

Like driving, but actually whether it's new energy vehicles or gasoline cars, there are massive amounts of technology and industry accumulation behind them ensuring safety. It's precisely because of these systems that you dare drive so fast.

👦🏻 Koji

So on the information highway, we similarly need this kind of security infrastructure — it's just that many people don't normally see it.

👦🏻 Tao Wei

Right, confidential computing is meant to provide this kind of security system. With these guarantees, data source parties dare to bring out their data for processing and application.

👦🏻 Koji

In the confidential computing field, are there different schools of thought? For example, some advocate one approach to security while others have their own technical preferences?

👦🏻 Tao Wei

Confidential computing is actually part of a larger technical system we call "privacy-preserving computing." Within this system, there are several different technical routes.

The first is the pure cryptography route, such as multi-party secure computation and fully homomorphic encryption. It relies entirely on cryptographic algorithms, requiring no chips or infrastructure, and offers the highest security level. But the problems are also obvious: fully homomorphic computation, for example, may be 100,000 times slower than plaintext computation, and data can expand 10,000-fold. Data that was originally 1GB might become 10TB after processing.

The second is confidential computing, which is mainly implemented through CPU memory encryption and system security, establishing a trusted root inside for security assurance. All computation is decrypted only in the CPU cache for relevant processing. But this operation is transparent and remains in confidential state to anyone — we call this hardware confidential state.

The third is federated learning, whose approach tolerates some information entropy leakage to perform AI-related computations, and can be faster.

These technical approaches differ dramatically in their security assumptions and implementation methods. The industry has already made many attempts, and we can see them gradually being adopted and accepted in different scenarios.

But with such vastly different technologies, how do we measure their respective security levels? Even internationally, there's no consensus on this.

👦🏻 Koji

Is it still impossible to measure today?

👦🏻 Wei Tao

Actually, over the past two years, we've done something we're quite proud of — we proposed a measurement framework. The core idea is this: regardless of which technology you use, the ultimate standard for measuring security is how much cost an attacker must bear and how much uncertainty they must overcome to breach your protections.

This mechanism is universal. Whether applied to privacy computing, data security, or website security, the principle is the same. We've also worked with domestic and international evaluation agencies to advance related standards and conducted pilot programs with good results. It turns out these things can indeed be quantified and measured.

👦🏻 Koji

Is the data security protection from Ant Shield Computing only for Ant Group's own use, or can other companies use it too?

👦🏻 Wei Tao

Ant Shield Computing actually has an evolution story. Back in 2016, we started developing different privacy protection technical approaches. They were then applied in areas like credit and risk control with good results.

By 2022, we felt these technologies shouldn't remain confined to Ant's internal use, so we chose to open-source them.

The response after open-sourcing was excellent — many vendors got involved, and applications expanded internationally. But we also discovered that because the technical barrier is so high, those who could actually use it were mostly large companies with strong technical capabilities. Most small and medium enterprises lacked the ability to adopt it. So we then established a true commercial company called "Ant Shield Computing," hoping to make this technology more accessible.

👦🏻 Koji

After establishing Ant Shield Computing, what specific services or assistance will you provide to SMEs?

👦🏻 Wei Tao

In recent years, the National Data Administration has been vigorously promoting "data element marketization" reform. The core goal is to enable all industries to truly put data to use and unlock deeper value. But the challenges are significant: digitalization levels vary widely across industries, and coupled with concerns about data security, data generally lacks processing, integration, and verification.

On the other hand, together with many peers and universities, we've continued to overcome technical hurdles. Now it's not just about top conference papers — we have mature open-source practices and large-scale applications. According to Ant's vision, we hope to bring some "small yet beautiful" changes to society through confidential computing. For example, we partnered with MYbank and the Ministry of Agriculture and Rural Affairs' Big Data Development Center to apply confidential computing in rural lending scenarios.

In the past, farmers had difficulty obtaining loans because their assets were farmland, so banks had to send people to inspect fields in person. The cost was too high — the interest generated from farmers' loans themselves couldn't cover it. This made the commercial cycle unsustainable.

👦🏻 Koji

So how exactly does Ant Shield Computing participate in farmer lending?

👦🏻 Wei Tao

We do this together with MYbank. On one hand, we use remote sensing large models to assess farmland conditions. On the other hand, we use confidential computing to compare the land information provided by farmers with public data, confirming that the land actually belongs to them. This eliminates the need to send people to inspect fields in person.

This was first piloted in mid-2023 in a county in Jiangxi, with excellent results. It relies entirely on technical trust without manual intervention — data neither leaks nor gets misused during the process. After the pilot's success, with support from relevant authorities, this system quickly expanded to over 2,600 counties nationwide.

👦🏻 Koji

So the farmers actually have no idea what's happening behind the scenes.

👦🏻 Wei Tao

People can just enjoy the convenience that comes with it.

👦🏻 Koji

Then what's the biggest change here? For instance, banks not needing to send people for inspections — is this brought by remote sensing or by confidential computing?

👦🏻 Wei Tao

Both are important. Remote sensing handles assessment; confidential computing handles asset verification. Only by combining them can it truly be implemented.

Similar confidential computing applications also exist for new energy vehicles. The biggest feeling people have driving NEVs is that electricity is cheap, but insurance premiums are expensive and keep rising. This is because insurers' loss ratios on NEVs exceed 100% — basically "lose money on every policy" — so insurers have strong motivation to reform.

Why are payouts so high? On one hand, battery risks are significant. On the other hand, with integrated body structures and numerous sensors, even minor collisions incur high repair costs. What's more troublesome is that NEVs have such strong initial acceleration that people with poor driving habits can easily cause accidents with one hard step on the pedal.

👦🏻 Koji

So NEVs also have higher accident probability?

👦🏻 Wei Tao

To a large extent it's related to driving habits. So insurers particularly want to aggregate data from vehicles, drivers, and insurance claims, then analyze which are high-risk populations and who has good driving habits, enabling precise pricing to bring premiums down. This is actually something Ant achieved in collaboration with insurers and OEMs, using confidential computing to connect data. Many people might not realize that confidential computing is working behind this.

👦🏻 Koji

Before confidential computing emerged, was data disconnected because all parties were unwilling to share?

👦🏻 Wei Tao

Yes — data on people, vehicles, and insurance is all too sensitive. Similar situations exist with medical insurance. The healthcare system has massive amounts of high-value, highly sensitive data and enormous reform demands, especially for connecting with commercial insurance. But this was previously considered nearly impossible. As late as last December, some experts were calling it "industry self-delusion."

Because medical insurance data sits with the healthcare administration, while commercial insurance data resides with various insurers — they simply couldn't be shared. But this July, the nation's first "health insurance and commercial insurance" clearing and settlement center went live, with confidential computing technology supporting it behind the scenes, enabling data verification and settlement under the premise of "no leakage, no misuse." These technologies sound distant, but they're actually already serving everyone.

👦🏻 Koji

Indeed, quite remarkable. I'm wondering — if we took this to Africa, would such technology be unusable?

👦🏻 Wei Tao

You'd be surprised — Africa is using it now. When we were doing events for the SecretFlow open-source community, Transsion, Africa's largest phone manufacturer, came to participate. We were quite astonished. Later we discovered that Africa's digital development is happening very quickly. Whether for risk control or marketing, compliance requirements for data across countries are increasingly stringent. So they have genuine needs too.

Large Models Meet Confidential Computing: Higher-Order Programs

👦🏻 Koji

Since Crossing is a blog very focused on AI, I'd also like to ask: after the rise of large models, what's the relationship between them and confidential computing? Will it make confidential computing more important?

👦🏻 Wei Tao

That's a good question. Confidential computing actually divides into two categories: confidential general-purpose computing and confidential intelligent computing.

What we see today is that large model applications broadly fall into two situations: one is using them as general services, using public network large models; the other is specialized applications involving enterprises' sensitive data. In the second case, the problem becomes prominent. Because whenever compliance and data security are involved, enterprises typically prohibit directly handing sensitive data to external large models. But at the same time, the productivity gains and substitution effects brought by large models cannot be ignored.

👦🏻 Koji

Yes, if you don't use them yourself, your competitors will

👦🏻 Wei Tao

Exactly, so many enterprises can only choose private deployment. But the problem is that privatization is not only expensive but also troublesome to upgrade. So now we're seeing a stronger demand: can we use large models securely and compliantly on the public network? And confidential computing is the best solution.

Moreover, being on the public network has cost advantages. For example, on Alibaba Cloud, the full-power DS token price is the same as Qwen 3 — many people haven't noticed this. Because of the large data scale, I can use various technologies like PD separation to significantly reduce inference costs, which is much cheaper than private all-in-one machines. If you add confidential computing on top, costs can even be around one-third of privatization.

Another important point: in public network mode, you can enjoy rapid technological iteration and upgrades without doing your own operations and maintenance, and without worrying about assets quickly depreciating. This is actually a huge opportunity. And today, large model applications themselves are still rapidly evolving.

For example, last month at WAIC we released the "Higher-Order Programs" large model trustworthy application technical framework. Many people think large models have already transformed industries, but the problem is that all large model applications today basically require human supervision — afraid that one wrong sentence could cause big trouble. People often think this is a "hallucination" problem, but we found that the root cause isn't hallucination at all.

The problem lies in how people are using large models today — it's still wrong. They're not using engineering methods but still operating like a "handicraft workshop," throwing all problems at the large model to solve. But in reality, large models' processing capability drops sharply as scale expands.

(Image source: Internet)

👦🏻 Koji

Then what's the biggest difference between "handicraft workshop" usage and "engineering" usage?

👦🏻 Wei Tao

The biggest difference lies in the carrier for task description. Nowadays everyone feels you must use natural language to count as AI, while using programming language seems outdated. But actually, natural language is a terrible engineering carrier. Its semantics are vague, lacking boundaries and priorities, making reliability difficult to guarantee. Let me give two examples: one is a joke — a wife asks her husband to buy three pounds of peaches, and if he sees watermelons, buy one. The husband comes back with just one peach, because the logic is ambiguous — it's unclear whether "buy one" refers to peaches or watermelons.

Another is the "Three Laws of Robotics." It sounds like it's meant to ensure robots don't harm humans, but "not harming" itself is very vague. If a robot interprets this as "the outside world is too risky," it might lock humans in a room, thinking this is the safest. But could anyone actually accept that?

This is why natural language is not a good carrier in engineering applications.

Of course, natural language has its strengths. Precisely because of its vagueness, it's very suitable for carrying knowledge and concepts. But the problem is that current applications use either all natural language or all programming language — the two are completely separated.

What we're doing is combining the two: letting natural language carry the knowledge parts, and programming language carry the logic parts. The benefit of this fusion is that it allows large models' tasks to be broken down more finely and specifically, thereby reducing their cognitive pressure.

It's the same with humans. If you're suddenly thrown an extremely complex task, like healthcare reform, you'd definitely be overwhelmed — except for true industry experts, almost no one could handle it well. But if you decompose the task into small pieces, even novices or college students have a chance to do things well.

👦🏻 Koji

Then what's the starting point for input? Natural language, or do you need to use programming language from the start?

👦🏻 Wei Tao

The starting point can actually be natural language, but the core is to achieve three things: explicitness, controllability, and convention.

The first step is explicitness. That means making the task-processing workflow explicit. We call the hybrid form of natural language and programming language a "high-order program." In this process, the large model can first make explicit what it thinks the processing flow should be, while industry experts need to verify it — this ensures professional requirements are met. It also forces experts to refine their domain knowledge, achieving a fusion between the large model and human expertise.

The second step is controllability. Right now, many people use large models by simply "tossing in a task → getting a result," with no verification step. But just like students doing math problems, you have to check your work after finishing.

👦🏻 Koji

Right, like leaving ten minutes before the exam ends to review your answers.

👦🏻 Wei Tao

Exactly. But today people habitually don't give large models a chance to check, and there's no such mechanism. Once we break tasks down into natural language and programming language, we can verify at the finest granularity. Having humans do the checking often goes against human nature, because no child likes checking homework. But large models are different — you just hand the checking task back to them, and they'll execute it as soon as they're "powered on." This makes it much more feasible. That's what I mean by controllability.

It's no longer the simple "toss in a task → get a result" model. Instead, verification needs to be introduced at key junctures. There's deterministic verification and non-deterministic verification, and they can quickly expose the capability boundaries of large models. Previously, something like ChatGPT would always give you an answer, but once you add verification, you can clearly see where its boundaries are — many times it fails the verification too.

The final step is convention. This means the entire system needs to be validated with real-world scenario data to see if results meet industry requirements. If they don't, the system needs to be improved in reverse: key programs need more refinement, verification steps need strengthening. Through this kind of iteration, we can guarantee outputs truly meet industry standards.

What's missing in large model applications today is precisely this kind of "high-order program" system. Through the combination of explicitness, controllability, and convention, we can enable large models to achieve the reliability required across industries.

👦🏻 Koji

How did you come up with pushing for "high-order programs"? It doesn't sound directly related to confidential computing.

👦🏻 Wei Tao

I actually don't just work on confidential computing. For over twenty years in the industry, my core work has been making complex systems safer and more reliable. When AI emerged, it was inherently unreliable, so naturally it became a research subject for me. In the industry context, there are now two enormous challenges: security assurance capability, and data processing capability. On the security side, we've laid the groundwork over the years, and the most important gap for confidential computing to address next is actually improving data processing capabilities — especially since large models emerged.

The key question is: how do we make AI truly work reliably? Many people treat AI as a "crutch" for humans, but I think this understanding is backwards. Today's large models have already surpassed most people in certain domains, like the college entrance exam or math olympiads, yet they fail at some of the most basic things. The problem isn't the large model itself — it's that we're using the wrong approach.

For example, in factories we don't expect one person to do everything. Instead, we use assembly lines to break tasks down very finely, with clear division of labor at each step. But when using large models, we always expect them to be "perfect," making no mistakes at all. That's the problem — we're using the wrong method.

If we truly treat large models as a productive tool, we should manage them with an engineering mindset, rather than continuing with a "handicraft workshop" approach.

👦🏻 Koji

So have you shared this perspective with the Qwen team, or other large model scientists?

👦🏻 Wei Tao

Yes. I've talked with many experts who have both AI backgrounds and engineering backgrounds, and they all strongly agree — they see it as the only path forward. Actually, you'll notice that Qwen 3's core model that's used most is 32B. They have larger ones too, like 235B and 480B, but the most commonly used, most core one is really 32B. The 32B is very much like an assembly line model.

👦🏻 Koji

An assembly line model?

👦🏻 Wei Tao

Right. The 32B can fit on a single card, the cost is low, and it's very well-suited for our "high-order program" applications. Right now everyone thinks large models should be capable of everything, but the reality is that in industrial scenarios, those ultra-large models are often too expensive, and not necessarily more reliable than 32B. Instead, this kind of "engineering model" like 32B, interacting with human experts as a copilot, is an excellent application scenario.

So we believe the future will definitely be different models for different scenarios. Just like cars — there won't be just one universal engine; different vehicles should have different engines matched to them.

Commercialization Challenge: Being the Pioneer Who Eats the Crab

👦🏻 Koji

With the "high-order program" and "confidential computing" you just mentioned, I feel like you've always been looking for big, exciting problems to tackle, simplifying complex things and then solving them. Now as chairman of Confidential Computing, you have to face not just technology but also growth, business, and more complex challenges. How has this past year or so felt?

👦🏻 Wei Tao

That's a great question. I think this is the confusion most technical people face when transitioning. We're still on the path of exploration. Today's confidential computing is a bit like when Dr. Wang Jian was pushing cloud computing over a decade ago. At first he was even called a "fraudster," and I'm at least luckier than him — no one's said that about me (laughs). But the core is believing that this can truly bring value to society.

The advantage of confidential computing is that it's an entirely new blue ocean market. From concepts to architecture to systems, much of it was pioneered by us. But the challenge is also here: it's not a mature market. The concepts, technology, products, even policy aspects — all need us to push forward. Fortunately, with guidance from the National Data Bureau, "data elements" is already a core national strategy, and demand is very strong. Inclusive credit, medical insurance, auto insurance — these industries all have clear pain points, and once data is applied, it can produce significant business results.

So we pilot with partners "willing to eat the crab first," establish industry benchmarks, and promotion becomes much easier. In the past people worried confidential computing was too expensive or couldn't process data, but over the past two years we've validated its feasibility in complex scenarios, and next we can deploy more broadly.

Essentially, confidential computing changes people's fundamental understanding of data. Previously, everyone thought you had to hand over plaintext data to use it, but the risks were too great — people didn't dare. Confidential computing provides a new approach. We see it as new infrastructure: an end-to-end secure, full-process controllable infrastructure where regardless of who operates or develops it, data is always protected.

This also enables new circulation models: data can be processed, fused, and verified without flowing in plaintext. Traditionally "data doesn't leave the domain" — the domain was asset-bound, mutually exclusive, leading to shallow fusion. Under confidential computing, the "domain" transforms into a virtual security domain based on key management. This new domain not only provides stronger protection, but is also scalable, fusable, and auditable, enabling deep data fusion and deep application.

👦🏻 Koji

Convincing the other party to establish trust is actually quite hard. Because if data isn't protected well, the other side could face catastrophic losses. Do you ever encounter partners demanding very strict contracts, where if something goes wrong you have to pay enormous damages?

👦🏻 Wei Tao

Actually, we're very happy to push the industry toward data security insurance. In the United States, this is already a mature mechanism: first compliance admission, then insurance backing it. For example, in California, any internet service involving personal information must carry mandatory cybersecurity insurance, just like compulsory traffic insurance domestically. If an incident occurs, insurance pays first, but premiums rise afterward. Through this mechanism, an industry closed loop can form.

In China, we're working hard to promote a similar mechanism. We're not afraid of paying out — the key is getting the market mechanism running. But domestically, it's still primarily administrative accountability, not yet connected to marketization, so the closed loop hasn't been established. The result is that everyone can only demand "absolutely no errors."

Our confidential computing system itself benchmarks against Level 4 of the classified protection technical standard, the highest security level achievable commercially in the industry. Partners who have used it are basically convinced of its protection capability. At the same time, we've also submitted the same code to the nation's most authoritative evaluation agency for code security analysis, traceability, and filing. This work is currently underway, aimed at further ensuring trustworthiness.

Overall, what we provide the industry is the highest cost-performance full-chain security assurance solution. Deploying with confidential computing costs much less than retrofitting a bunch of security measures after the fact, while the assurance capability is significantly higher. Only this way can we truly dispel the psychological pressure on all participating parties.

👦🏻 Koji

Earlier we mentioned that the "SecretFlow" open source community initiated by Ant just had its third anniversary. I've also seen some of your sharing, where you said you "grew up soaking in open source communities." Can you recall which communities you were most active in when you first encountered open source? Were there any experiences that particularly influenced you later?

👦🏻 Wei Tao

Actually, Ant has always had a very active open source culture internally, and I've personally participated in many projects. I once wrote a message for an Ant open source event — "Open source is the first time in human civilization that end-to-end engineering implementation details have been shared with the world. This great model has enormously accelerated the digital revolution. Compared to traditional books, patents, or classroom education, open source opens knowledge to the world in an unprecedented way. Behind this is a spirit of expectation and goodwill. We learn in open source, we grow in open source, and we respond to this expectation without betraying this goodwill. This is the luckiest thing in the world."

👦🏻 Koji

Right, open source was truly selfless at first, completely showing end-to-end engineering implementation.

👦🏻 Wei Tao

Yes, what moved me most was still Linux. Around '93 or '94, when I was in university, there was a classmate in my dorm who later became the webmaster of the "YiTaHuTu" BBS. He was the first to tell me about Linux, that it was amazing. At the time I dismissed it. By '96, Linux was just starting in China. There was no good distribution medium, so everyone copied it around on floppy disks. Back then, a teacher's lab at the Chinese Academy of Sciences had a CD burner, so I made China's first double-sided Linux CD — one side was Red Hat, the other was Slackware. I took these CDs to sell on the Linux BBS boards at Tsinghua, Peking University, and the Chinese Academy of Sciences, selling several hundred copies total. That was probably, in a sense, China's first true Linux distribution.

👦🏻 Koji

There weren't really open source licenses back then? So you burned CDs to sell.

👦🏻 Wei Tao

No. Red Hat and Slackware were already open source, free to distribute. Redistribution was perfectly fine. That's the spirit of open source. At the time, I was mainly focused on the Linux kernel, and low-level software like GCC and LLVM.

Later, when I was at Founder and Peking University, I worked in cybersecurity for a while. Core network processing depended on netfilter in the Linux kernel. I'd carry around a small notebook, doing all kinds of kernel state analysis and debugging. When I moved on to network processors later, it was still based on that same system. I really felt lucky back then — in any other technical environment, I wouldn't have been able to get my hands on truly production-grade applications so quickly. Open source gave me that opportunity, letting me enter the world of professional technology much faster.

👦🏻 Koji

Makes sense. I studied computer science too. But listening to you just now, a scene suddenly came to mind. For classmates studying aerospace or automotive engineering, getting their hands on the world's best design blueprints would take a decade of espionage. But computer science students can just look at all the open source code in the world.

👦🏻 Wei Tao

Exactly. The reason behind it is that software carries such enormous socialized labor that it's beyond any single company's capacity — even industry giants can't handle it alone. So open source became inevitable, bringing together the world's top talent to do things as well as they can be done.

Think back to when Linux first appeared in the '90s — it was still niche. Around 2000, Windows was dominant. But in the blink of an eye, now virtually the entire production environment runs on Linux. This shift happened quietly, and it makes us more certain: open source may conflict with commercialization in some places, but it's absolutely critical to the progress of human civilization.

👦🏻 Koji

When you first started the SecretFlow open source community, what was your goal?

👦🏻 Wei Tao

There were several layers to it. First, privacy-preserving computing is fundamentally a security technology. If it's a "black box," how can anyone trust it? How can they evaluate whether it's secure? Once security lacks transparency, you get the "lemons market" effect — bad money drives out good. For example, some vendors crank security parameters to the max during testing, then drop them to the minimum when benchmarking performance. Consumers can't tell the difference, so they get misled. That's why we chose open source: to provide transparency, so the industry can truly understand and master security standards.

Second, this industry needs more people who can grow on such a platform. Privacy computing needs far more than just Ant or a handful of companies. More talent, more teachers and students should have a stage to learn and grow. And the application scenarios go way beyond finance — like the Transsion phones in Africa we mentioned, which was an unexpected case.

👦🏻 Koji

Right. If you hadn't gone open source, maybe a company like Transsion would never have entered the ecosystem.

👦🏻 Wei Tao

Exactly. So we debated internally for a long time, but ultimately chose open source — and it proved to be the right call. Of course, commercialization inevitably took some hits.

👦🏻 Koji

What was the biggest controversy at the time?

👦🏻 Wei Tao

The biggest debate was whether open source would hinder commercialization.

Later we found that the two actually run in parallel. The services commercialization needs don't conflict with open source. On the contrary, open source expands market reach, which actually benefits commercialization. You just need to balance short-term and long-term gains. For instance, a module that used to sell for millions might not command that price after going open source, but it brings in far more customers. More importantly, the real value isn't the computing module itself — it's the business running on top of it, which generates value far exceeding any single technical module.

👦🏻 Koji

Over these three years, what has given you the most sense of accomplishment?

👦🏻 Wei Tao

I think there are a few things.

First, those application scenarios I mentioned — confidential computing is really bringing small but meaningful changes to the industry, serving the public and ourselves almost unnoticed. That's very gratifying.

Second, talent development. At first we were researching together with university teachers and students. Later, we saw more and more teachers and students able to independently publish top-tier conference papers using SecretFlow, without our involvement. That's very fulfilling.

Finally, ecosystem feedback. At SecretFlow events, students have said it's "easy to use, convenient, with high code quality." And companies like Transsion, plus many peers, are using SecretFlow — far beyond what we imagined. This feedback makes me feel we're truly giving technology back to the world, and laying a good foundation for the future.

This year's third-anniversary event has seen even more industry enterprises joining. In the past, SecretFlow mainly focused on the privacy computing technology framework. Now, we're moving toward an open source system for the full stack of data circulation technology. This shift marks a new starting point. I'm especially proud of that.

👦🏻 Koji

Some people now feel open source has become a competitive tactic, no longer so pure. OpenAI is mocked as "ClosedAI"; Meta initially championed open source but is now wavering. It seems everyone ultimately open sources for commercial ends. What do you think?

👦🏻 Wei Tao

I think the integration of open source with corporate commercial strategy is inevitable. But we can't put a company on a "moral high ground" and demand it stay open source forever. Open source was never any single company's sole responsibility — it's the result of the entire industry's collective effort. A company choosing open source at one stage may be to advance the industry; choosing closed source at another may be out of commercial considerations.

In the long run, the industry will find relative balance, and the ecosystem will evolve through the dynamic between open and closed source. I believe everyone will eventually find equilibrium — a reasonable position between open source and commercialization. That's the industry future I firmly believe in.

In Ant Group's confidential computing practice, we've also found that the inclusive value of commercialization matters greatly. The direct beneficiaries of open source are often technically capable programmers, but many SMEs lack the ability to use open source directly — that's where commercialization serves them. So don't oppose commercialization and social benefit. Finding a more inclusive business model is itself an important contribution to society.

AI's Impact and Reflections on the Future

👦🏻 Koji

I'm also curious — has AI brought any pleasantly surprising changes to your personal life, your family, even your children? Or any challenges?

👦🏻 Wei Tao

All parents and teachers are pretty anxious now: how should we educate children? Large models can pass the gaoxao, with such broad knowledge coverage — so what should we teach? I worried at first too, but gradually figured it out: we must embrace large models, embrace new technology. But some core things never change: seeking truth, being pragmatic, learning to verify. Whether it's a large model or self-media telling you something, don't just take it at face value.

People often say large models "hallucinate," but information distortion exists across all channels. The key is, how do you avoid losing yourself in such an information environment and maintain independent judgment? That has never changed. Especially today, with media full of sensationalist articles, children especially need to learn to form their own independent views.

Often, people know nothing about something, then read one article and immediately develop strong emotions — either extreme love or extreme hate. The key is still to have your own judgment, don't let emotions manipulate you easily. What's more important is elevating cognition. Only with elevated cognition can you truly use large models well, rather than being led around by them.

👦🏻 Koji

But how exactly does one elevate cognition?

👦🏻 Wei Tao

My experience is that learning must be systematic. Large models can be excellent study companions — their knowledge is extraordinarily broad, but they also make mistakes. So you need your own learning system, to achieve systematic understanding in some domain, form your own views, and constantly verify them. Large models can't replace that. Only then can you truly leverage them, raising efficiency to previously unimaginable levels. This may be the most core capability children today need to master.

👦🏻 Koji

So Wei Tao, how old is your child now?

👦🏻 Wei Tao

Fifth grade next semester, 10 years old.

👦🏻 Koji

Then when facing social environment and technological progress, how do you think about what education or guidance to give your child?

👦🏻 Wei Tao

I think he's still young, so there's not too much pressure. But he already uses some AI tools for homework — Doubao, and Youdao's translation pen. When I meet friends from Youdao, I tell them I hope such tools get even better, so my kid can ask me fewer questions (laughs).

Many people wonder, should we learn programming? Should we learn math? I think absolutely. As I mentioned before with "higher-order programs" — it enables using programming languages as technical languages. Large models themselves can program; if humans can't at all, they'll lack a critical capability.

What's special about programming is that it's one of the very few human activities that truly requires large-scale, airtight logical deduction. Much of our daily work doesn't demand thinking depth beyond middle school math, but programming is different — it's an enormously complex system that cannot tolerate errors. This kind of logical training, I believe, remains very important.

👦🏻 Koji

So what approach are you using to get your child practicing programming?

👦🏻 Wei Tao

He's already passed Python Level 7. Started young, and really enjoys it. I think it's actually quite easy — Python programming is genuinely easy to pick up.

👦🏻 Koji

Want to do some "product placement" on our podcast? Which training institution or app does he use (laughs)?

👦🏻 Wei Tao

Haha, but seriously, it's great exercise for kids. He also likes robots. But the entire education system is actually quite utilitarian. I even asked his school teacher — robot competitions seem great, could there be more support? The teacher said even winning first place at international competitions wouldn't improve the school's college admission rates at all.

👦🏻 Koji

So everyone's "starting with the end in mind" — just with different endpoints.

👦🏻 Wei Tao

Right. Kids today actually have easy access to many things we dreamed of as children. But unfortunately, they have too many choices. My wife, as a child, only had one idiom dictionary for extracurricular reading, so she read those idiom stories over and over until she knew them cold. Today's children have such abundant resources that they often can't get through them all, and反而容易迷失。

👦🏻 Koji

Do you ban your child from watching short videos?

👦🏻 Wei Tao

Can't stop it.

👦🏻 Koji

The spirit is willing but the flesh is weak.

👦🏻 Wei Tao

Fundamentally, children's self-control isn't there yet. Give them any electronic device and they'll definitely watch short videos. So parents must exercise control and guidance. But the upside is, if they're genuinely interested in something, there are now massive resources to support and push them deeper. That's much better conditions than we had back then.

👦🏻 Koji

So is there anything that's become especially easy or convenient today, particularly because of AI?

👦🏻 Wei Tao

Here's an example: robot vacuums are genuinely great now. Actually, this isn't just about AI — it's a reflection of the entire Chinese industrial system leveling up.

When I was in the United States, I used quite a few robots, including robot vacuums, and the experience was pretty bad back then. After cleaning, hair would get tangled around the roller brush and you'd have to cut it free with a knife — a real hassle. Mopping would also leave behind odors.

Today those problems are solved: no more hair tangling, the water tanks deodorize thoroughly, and the overall automation is extremely high. Behind all this is really the accumulation and transformation of China's industrial system over decades. It genuinely feels like "breaking out of the cocoon and becoming a butterfly."

👦🏻 Koji

There was some data recently: among this year's fresh graduates in the United States, computer science majors had a 6% unemployment rate, while art majors were at just 3%. This is directly tied to the impact of AI coding. I'm also curious — you've been in the industry for over twenty years. Has the AI impact been significant for you?

👦🏻 Wei Tao

I feel like it's been okay. From the perspective of an industry expert, AI still has plenty of flaws right now.

👦🏻 Koji

So you're not at all worried that AI will affect your value?

👦🏻 Wei Tao

I'm not worried. What AI is best at is actually helping industry experts amplify their value even further. It can't turn a junior programmer into a senior programmer overnight, but it can multiply a senior programmer's efficiency several times over. In the past, a senior programmer had limited energy and needed to manage many junior programmers — once the team got large, complex production relationships would emerge.

Now AI has greatly simplified this process, and the efficiency gains are very noticeable. The higher your industry cognition, the more AI can amplify it. In other words, those who truly get the multiplier effect are practitioners with sufficiently high cognitive levels. The core thing is that you need to continuously elevate your cognition, rather than getting drowned in repetitive labor.

Every technological transition brings massive disruption — that's inevitable. Just like when computers first appeared, many jobs disappeared, but computers also created much larger industry opportunities. If you don't embrace new technology, you'll either get eliminated or be forced by society to embrace it.

👦🏻 Koji

You just mentioned that AI offers limited help to junior programmers but can multiply senior programmers' efficiency. So how should junior programmers today grow into senior programmers? What advice would you give young engineers just entering the workforce to better improve themselves and seize future opportunities?

👦🏻 Wei Tao

This brings us back to today's theme: the enormous changes brought by open source and AI. Open source itself puts end-to-end details out there, but many people get the code and still can't understand it. With AI, it can explain the underlying principles for you, so you can learn faster and go deeper. And these resources are almost entirely open.

This is an opportunity unmatched by any other industry. For anyone with the initiative, they're facing the best learning environment in history. Open source communities themselves are very open — as long as you can contribute, everyone will welcome you.

For students in computer science, you absolutely must embrace large language models now. The improvement they bring is enormous, and the opportunities are plentiful.

In the past, programming required precise control of every single bit. Today, high-level programming has evolved into a fusion with natural language. Many things that were difficult to achieve in traditional programming languages can now be handed off to large models — it opens up entirely new realms of possibility. This isn't just a technical breakthrough; it's a moment of industry-wide reshuffling. Going forward, there will be even broader space in commercialization and industry applications waiting for everyone to explore.

👦🏻 Koji

Alright, let's wrap it up here for today. Thank you so much, Wei Tao, for the sharing — the content was truly excellent, and we look forward to having you back at "Crossing" again in the future.

👦🏻 Wei Tao

Sounds good, thank you.