A bank can assess an artificial intelligence (AI) model before deployment and still discover that it fails when conditions change. The same advances in AI are also giving fraudsters new ways to defeat identity checks and manipulate customer devices. These problems put model reliability and digital security on the same operational agenda.

On the third day of The Asian Banker Beijing AI Innovation Study Tour 2026, delegates visited the Beijing Academy of Artificial Intelligence (BAAI), where research focused on embodied intelligence, open-source infrastructure and model evaluation. At Tencent, they examined manipulated video streams, device intelligence and AI-assisted fraud investigations. The visits contrasted emerging capabilities that still require validation with security weaknesses banks must address in existing digital channels.

BAAI explores autonomous systems and the limits of controlled demonstrations

BAAI, a non-profit research institution established in 2018 with government support, operates differently from commercial technology providers. Its research programmes focus on areas where technical uncertainty, development costs and long investment horizons can make immediate commercial returns difficult to establish.

BAAI described research progressing from large language models and multimodal AI to embodied intelligence and world models. World models seek to represent an environment and the consequences of actions, potentially allowing systems to respond to situations beyond a narrowly predefined sequence of instructions.

This represents a different technical problem from the automation of fixed tasks. A conventional robotic system can repeat a programmed movement in a controlled environment. A more general-purpose system must interpret unfamiliar objects, adapt to changes and decide how to complete an objective when circumstances differ from its training.

During demonstrations involving robotic systems, delegates questioned how the machines respond to unexpected errors, whether processing takes place on the device or through connected systems, and what happens when an AI model produces an incorrect response.

One delegate asked whether a robot could be stopped immediately if its underlying model hallucinated or behaved unpredictably. The response indicated that this depended on the model and system architecture; it did not identify a specific emergency-stop mechanism.

That exchange exposed the difference between a successful demonstration and a system ready for unsupervised operation. For banks considering physical automation, performance measures would also need to cover failure detection, intervention, recovery time and responsibility when a system acts incorrectly.

BAAI acknowledged that more general-purpose world models remain at the research stage. Although narrower robotic applications are operating in settings such as hospitality, their ability to work reliably across unfamiliar environments without further training or supervision remains unproven.

Comparable figures for deployment scale, operating cost, task success and productivity were unavailable, making the commercial readiness of the broader technology difficult to assess.

BAAI examines independent evaluation as models evolve

BAAI also addressed the need to evaluate AI systems independently of their developers.

It described work on open-source models, evaluation benchmarks and testing across computing platforms. A strong benchmark result does not necessarily establish reliability in a bank’s specific business process.

A model may perform well on language reasoning or perception tests but fail when confronted with unfamiliar documents, incomplete information or operational conditions that differ from its evaluation dataset. Improvements in benchmark scores can also occur rapidly, reducing the useful life of a technology assessment conducted only a few months earlier.

Delegates explored how banks should evaluate models before deployment and how testing should continue once a system is in production. The discussion covered the trade-off between evaluation cost and the need to detect failures before they affect customers or operations.

BAAI's work on model evaluation and open infrastructure offers banks potential alternatives to relying exclusively on supplier-provided assessments. Open models and common evaluation tools may make it easier to compare systems and test them on institution-specific requirements.

The immediate relevance to banks is methodological rather than a demonstrated reduction in losses, compliance breaches or operating costs: common evaluation tools could help institutions compare models systematically instead of relying solely on suppliers’ assessments.

Delegates also questioned how research developed by a small specialist institution reaches wider industry use. BAAI described cooperation with universities, companies and research teams, including the formation of commercial ventures to develop products from earlier research.

This approach separates the production of new scientific capabilities from the engineering, distribution and customer support needed for commercial deployment. It also means that banks should distinguish between research produced by BAAI, technology commercialised by companies emerging from its ecosystem and applications independently validated in production.

Tencent demonstrates vulnerabilities in facial identity verification

At Tencent, the focus shifted from emerging research to security weaknesses in digital banking.

Tencent demonstrated an attack in which AI-generated facial video was introduced into an identity-verification process. According to the presentation, the simulated attack bypassed a biometric check in about 22 seconds.

The concern was not only that the synthetic face appeared convincing. The demonstration showed how a manipulated video stream could be supplied to the verification system, allowing back-end controls to receive apparently valid facial information without establishing that it came from a genuine live camera capture.

Banks have long confronted altered documents, photographs, replay attacks and physical masks. Synthetic media and camera-stream manipulation introduce another vulnerability: the digital representation may appear credible even when the physical capture process has been compromised.

Tencent argued that face matching and liveness detection are therefore insufficient on their own. The company outlined an approach combining biometric checks with device integrity, application behaviour and verification of the media stream.

The 22-second result illustrates a potential vulnerability, rather than the frequency of successful attacks on live banking systems. The effectiveness of Tencent’s countermeasures in reducing fraud losses was not quantified.

Even so, the demonstration raises a practical question for banks conducting remote onboarding or authenticating high-risk transactions: a strong facial-match result does not, by itself, establish that the person shown is physically present.

Tencent extends fraud controls to devices and application behaviour

Tencent's broader security approach uses information about mobile applications and device behaviour to identify suspicious activity before it reaches a bank's transaction-monitoring systems.

The company described how malicious applications, screen sharing and remote-control software can be used in social-engineering attacks. In some cases, a legitimate customer completes identity verification while an attacker subsequently controls the device or influences the transaction.

A delegate challenged the apparent weakness of know-your-customer checks in such cases. The response was that conventional identity verification may succeed because the customer is genuinely present; the fraud occurs through manipulation of the customer's device or subsequent actions.

For risk teams, the distinction matters. Identity verification can confirm that a legitimate customer is present at one moment without establishing that the customer is acting independently or that the device remains secure.

Tencent described using device-level signals and intelligence gathered across its broader technology ecosystem to identify suspicious applications and behaviour. Unlike controls based only on a bank's own customer history, this approach can potentially identify threats previously observed elsewhere.

The company also discussed adapting risk controls according to the stage of the customer journey. A suspicious device signal during an ordinary login may warrant additional monitoring, while the same signal during a password reset or high-value transfer may justify stronger intervention.

Delegates questioned how such intelligence is shared between institutions and how it differs from the fraud-detection systems banks already operate. Tencent's explanation centred on the breadth of its device and application observations, which can supplement an individual bank's transaction data.

That potential advantage must be weighed against data-protection obligations, signal quality and the possibility of restricting legitimate customers. Comparable reductions in fraud losses or false positives across banking deployments were not quantified.

Document integrity and AI-assisted investigations offer nearer-term uses

Tencent also presented a way to reduce document manipulation during digital lending and onboarding.

Rather than accepting a statement or other financial document that a customer has downloaded and could subsequently alter, the proposed workflow retrieves information through a controlled connection or guided process and passes it to the receiving institution.

The method is intended to reduce opportunities to edit documents between their source and the bank's verification process. Delegates questioned how it would work across jurisdictions with different open-banking infrastructure and whether it required cooperation from the institution holding the original data.

Tencent acknowledged that implementation varies by market. Where established data-sharing infrastructure exists, direct connections may be available. Elsewhere, additional application-level processes may be required.

The distinction matters because preventing document alteration is not the same as validating the underlying financial information. Banks must still assess source authenticity, customer consent, data completeness and the reliability of any third-party connection.

The company also demonstrated AI-assisted fraud investigation, including the generation of case summaries and support for reviewing suspicious activity. These applications address an established operational burden: investigators must combine transaction information, device signals and other evidence before deciding whether to escalate or close an alert.

AI may help investigators organise these inputs. Without comparable figures for investigation time, staffing impact, false positives or prevented losses, its demonstrated benefit remains a workflow capability rather than a quantified productivity gain.

Banks must test reliability and security beyond demonstrations

The two visits revealed related problems at different stages of AI adoption.

BAAI’s research showed how AI is progressing towards more adaptable and autonomous systems, while leaving questions about generalisation, independent evaluation and safe intervention unresolved. Tencent showed how synthetic media and device manipulation can undermine assumptions behind established digital identity controls.

For banks, the immediate lesson is to assess identity, device integrity, transaction behaviour and model performance together, rather than assume that any single check is conclusive. The relevance of each control depends on the decision at stake and the consequences of failure.

Commercial evaluation must also distinguish research-stage systems, controlled demonstrations and production deployments. Relevant measures include reliability under changing conditions, implementation costs, false positives, customer friction and reductions in operational risk. Supplier-reported capabilities are a starting point, not a substitute for results in banking environments.

As AI becomes more capable, banks will need to evaluate its benefits and the threats it enables as connected problems. The more consequential innovation may lie in testing, layered controls and the ability to intervene when systems or digital interactions fail.