# AI models
URL: /concepts/ai-models
Where Foxborne uses AI models, where they run and what checks each proposal before anything changes. None of them writes evidence or a finding.
Foxborne uses AI models in six places. Each is a job that a fixed rule or a hand-written parser cannot do well: reading a log format nobody wrote a parser for, finding the events that mark one moment on two clocks, checking what an engineer wrote against the records, turning an investigation into a rule, explaining a raw record, and searching by meaning.
The models never write evidence, a finding or an evidence level, and they make no before or after claim. Order still comes from the clock bounds, and conclusions still come from the engineer. A model proposes, deterministic code checks the proposal, and a person accepts it or not.
## Where they are used [#where-they-are-used]
| Feature | What the model does | What checks it | Who accepts it |
| ----------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------- |
| [Parsers for new log formats](/collect/import-files#import-a-format-foxborne-does-not-read-yet) | Reads the first lines of an unfamiliar text log and proposes the time column, its clock, and which columns say what happened and which are measurements | The parser runs over every line before anyone saves it: records read, times that go backwards, empty measurements | An admin saves the parser |
| [Matching events to align a clock](/investigate/align-a-clock) | Finds events on an unaligned clock that have a counterpart on an aligned one | The delay between the two is learned from aligned runs. The offset and its bound are arithmetic, and a pair seen on too few aligned runs cannot be used | The investigator applies the alignment |
| [Checking a finding against the records](/investigate/write-a-report#check-the-finding-against-the-records) | Lists what the finding claims: times, time differences, values, parameters and words that state a cause | Each claim is matched to the records: a time to an event, a difference to two records and their combined clock bound, a parameter to the run's parameter set | Nobody. It marks the text and never changes it |
| [Rules suggested from investigations](/rules/configure#rules-suggested-from-investigations) | Reads the findings of incidents for two rules that fire in order on one vehicle | The time between the two on the incident is measured, and the runs where both fired in 90 days are counted | An admin creates the rule |
| [Reading a raw record](/investigate/event#explain-a-record) | Explains the fields of a flight log message, journal entry, receive record or process sample, and says what the record does not show | Values are converted by code, such as KiB to MiB. The record stays on screen above the reading | Nobody. It is a reading aid |
| [Search by meaning](/get-started/console-tour) | Finds evidence that says the same thing in other words, such as USB disconnects and telemetry gaps for "radio" | Every result is an event with its ID, and opening it opens the record | Nobody |
## Where they run [#where-they-run]
The models run on an inference node inside your deployment, next to the workers. In the example deployment that is one `g4dn.2xlarge` node with one GPU in AWS GovCloud (US-West). **Hosting** shows it inside the data boundary as **Inference node**, and lists it under **Nodes** as **Inference (AI models)**.
* Nothing goes to a model provider. **Outbound connections** lists **AI model providers** as **None**: "Nothing. The models run on the inference node in your account. No record, prompt or result leaves it."
* The models ship in the signed release bundle, like the parsers, and air-gapped installs receive them the same way. **Settings** shows **Foxborne models 1.0, in the signed 1.4.2 bundle** with the SHA-256 of the weights. See [Upgrades](/deploy/upgrades).
* They read only what the person using them can open. Export-controlled evidence stays behind the US person check, as [Export control](/security/export-control) describes.
* Nothing is used to train a model.
Foxborne works without them. A deployment with no inference node, or with the models turned off, hides the six features and changes nothing else: parsing, alignment, rules, reports and exports run as before.
## Turn them off [#turn-them-off]
Admins manage the models in **Settings**, under **AI models**:
A switch. Off hides every feature below it. "Evidence, rules and reports are unaffected."
The inference node and your account.
The model release and the bundle it came in, with the SHA-256 of the weights.
"Only what the person using them can open. Export-controlled evidence stays behind the US person check."
"Change evidence, write a finding, or run a rule nobody created. Nothing is used to train a model."
The six features.
**Edit**
turns each on or off for everyone.
Each change is recorded in the audit log as **Changed AI settings**, such as **Models off** or **Reading a raw record off**.
## In the audit log [#in-the-audit-log]
Every accepted proposal is in the audit log with the person who accepted it:
| Action | Detail |
| ------------------------------- | ----------------------------------------------------------- |
| **Saved parser** | The columns, the clock and the file it was proposed from |
| **Created rule** | Version 1.0, with **from a suggestion on** and the incident |
| **Dismissed a rule suggestion** | The suggestion and the incident it came from |
| **Aligned clock by hand** | The offset and bound, ending **from a suggested pair** |
| **Changed AI settings** | What was turned on or off |
A finding check and a record explanation change nothing, so they add no entry of their own. Viewing evidence is recorded as **Viewed evidence**, as always.
## Next [#next]
The fixed checks that the models never replace.
Why a checked finding is still the engineer's.
The inference node among the other nodes.
Every accepted proposal, with who accepted it.