Inside Uber's AI Powered File Analyzer: 97% Fewer False Positives

Catch takes real action, so it only acts when it's certain — checking with you when unsure. Always on, never drops the ball. Safe for what matters most. Trust Catch at catchagent.ai.

Start delegating admin work

Most AI tools ask you to trade your data for intelligence. Norton Neo doesn't. It's the first safe AI-native browser built by Norton, and it gives you powerful built-in AI without handing your privacy over to get it. Search, summarize, and write with AI built directly into your browser. Your data stays yours. Your context stays private.

Built-in VPN, anti-fingerprinting, and ad blocking come standard. No add-ons. No setup. No compromises.

Fast. Safe. Intelligent. That's Neo.

Download Norton Neo

Porkbun is the domain registrar trusted by folks who want low prices without the nonsense. Get most domains at cost, free features like WHOIS privacy & SSL certificates, plus real 24/7 human support. Get $1 Off Your Domain

Every 11 seconds, a company somewhere gets hit by a data breach. The average cost? $4.88 million per incident. Now imagine you're Uber, processing 150,000 outbound files every year across Google Drive, internal tools, and collaboration platforms. Traditional keyword matching catches maybe half the real threats. The other half? It drowns your security team in false positives so noisy they can't tell signal from garbage.

Uber built something better. Way better.

Data Loss Prevention (DLP) tools have been around for decades. Most of them work the same way: scan outbound files for patterns like credit card numbers, Social Security numbers, or specific keywords.

Sounds reasonable. In practice, it's a disaster at scale.

Here's why. A spreadsheet titled "Q3 Revenue Projections" might not contain a single flagged keyword, but it's absolutely business critical. Meanwhile, a file with the word "confidential" in a boilerplate footer triggers alerts all day long.

Uber's security team was spending thousands of hours per year manually reviewing flagged files. Most of those reviews ended with "this is fine." That's not a security program. That's busywork.

Uber's CyberDefense team built the File Semantic Analyzer (FSA), a five module pipeline that replaces gut feel with AI powered classification. Let's walk through each stage.

Module 1: File Connector. The system intercepts files at every egress point. Google Drive uploads, internal collaboration tools, email attachments. If data is leaving Uber's environment, FSA sees it.

Module 2: Content Extraction. Raw files get converted into plain text. PDFs, spreadsheets, presentations, HTML pages, even images through OCR. The system doesn't just dump text either. It uses intelligent chunking that keeps semantic context intact across segments.

Module 3: Prompt Building. This is where it gets interesting. The system constructs optimized prompts for the GenAI engine, feeding it the chunked content along with classification context.

Module 4: Decision Engine. A rule based system that acts on AI outputs, including summaries, extracted entities, and intent classifications.

Module 5: Manual Review. Flagged files go to human analysts, but now those analysts get AI generated summaries and explanations instead of raw documents.

The core of FSA is a fine tuned large language model trained on meticulously labeled data. Subject matter experts classified thousands of files into three categories:

The LLM doesn't just classify. It does four things simultaneously.

Summarization. It generates a concise summary of what the file actually contains. No more opening 50 page PDFs to understand context.

Entity Extraction. It identifies named entities like people, organizations, dates, financial figures, and project codes. This tells analysts exactly what sensitive elements exist in the file.

Semantic Reasoning. It traces relationships across document sections. A file mentioning "Project Falcon" in one section and revenue targets in another gets flagged because the model understands the connection.

Intent Classification. It provides probabilistic assessments of the file's criticality with transparent explanations. Analysts can read why the model flagged something, not just that it did.

Here's the number that matters: 97% reduction in false positives.

Think about what that means operationally. If you had 1,000 alerts per week and 950 were false positives, you now have roughly 30 false positives instead. Your security team can actually investigate real threats.

The system also catches more true positives. Traditional DLP misses novel data formats and evasive techniques. Semantic analysis doesn't care if someone renamed a sensitive spreadsheet to "vacation_photos.xlsx." It reads the content, understands the meaning, and flags accordingly.

Three design decisions stand out.

Intelligent chunking over naive splitting. Most systems split documents by character count or page breaks. Uber's chunker maintains semantic coherence within each segment. This means the LLM gets meaningful context in every prompt, not randomly sliced paragraphs.

Human in the loop before enforcement. FSA doesn't auto block files in production. Flagged items go to analysts with AI generated context. This prevents the "cry wolf" problem where security tools block legitimate work and employees find workarounds.

Probabilistic over binary. Instead of "block" or "allow," the system provides confidence scores and reasoning. Analysts can calibrate their response based on risk level rather than treating every alert identically.

Uber's team is already exploring the next frontier: multimodal GenAI that can analyze images, video, and audio directly. Sensitive information embedded in screenshots, whiteboard photos, or recorded meetings would get the same semantic treatment as text documents.

They're also looking at integrating FSA's semantic classification directly into DLP enforcement. Instead of keyword blocking at the network layer, the system would use contextual understanding to make smarter, real time decisions about what data can leave the organization.

Follow me on Grind Eng Community ; Youtube ; LinkedIn ; X ; Instagram to stay updated.

See you in the next one!
Scortier, Signing Off!