Generative AI Project Prioritization
Learn about a framework for prioritizing GenAI projects based on business value, risk, and level of effort.
- What privacy and security guardrails can you get from the service hosting the model?
- What responsible AI practices does the model creator follow?
- If you’re using your own data, is it well-governed and unbiased?
- Do you understand the security implications of integrating a generative AI model with other systems and tools?
- Do your end users understand what generative AI systems can and cannot do well?
- What type of fine-tuning do you need? Prompt engineering is inexpensive and does not require a particular skill set. Retrieval-augmented generation (RAG) requires integration work. Transfer learning requires a training job. With all these types of fine-tuning, there’s a tradeoff to consider between the size of the base model you need, the cost of using that model, and the speed and quality of response. Start simple and evolve with the needs of business to optimize for quality, alignment and cost.
- Is this a novel problem? If you need to pretrain an existing model, or design a new model from scratch, you need to plan for long and costly training jobs, and a higher level of basic data science expertise on your team. Unlike traditional supervised machine learning, pre-training or custom fine-tuning an existing model may not converge into a better quality model that solves for complex use cases. generative AI pre-training requires domain expertise as well as engaging in AI applied science experimentation.
- Can you use a fully managed model service? If not, you will need to include additional operational tasks like basic infrastructure monitoring and scaling. generative AI production workloads have a very different profile compared to a typical 3-tier or web microservices architecture. Latency is often measured in seconds or 10s of seconds and compute cost per API call is much higher than a normal enterprise application. While observability tooling is rapidly evolving in this space, the do-it-yourself (DIY) investment in achieving operational excellence with LLM powered apps cannot be discounted.
- Will your model be exposed directly to external users? If so, you will need extra rigor in security and privacy guardrails. Beyond following the emerging security and privacy best practices (e.g. OWASP Top 10 for Large Language Model Applications), identify specific threat vectors applicable to your overall solution architecture for your use case. You can apply the probability and impact risk modeling to those threat vectors and prioritize mitigating the associate risk accordingly for the highest ROI on security assurance efforts.
- Do you have mature systems already in place for the pieces of the solution surrounding the model? As the diagram below shows, you may need some supporting capabilities in application hosting, data ingest, security, and operations. If you need to buy or hire new expertise, that will increase project cost and time.
Any opinions in this post are those of the individual author and may not reflect the opinions of AWS.