PaperlayerView exact revision on arXiv

Source-linked AI summary

Trustworthy AI: A Computational Perspective

Haochen Liu, Yiqi Wang, Wenqi Fan, Xiaorui Liu, Yaxin Li, Shaili Jain, Yunhao Liu, Anil K. Jain, Jiliang Tang

arXiv:2107.06641v3cs.AI

TL;DR

Trustworthy AI research is extensive but fragmented across dimensions and definitions. This survey organizes computational methods across six key dimensions, reviews applications and interactions, and identifies additional dimensions needing further research.

  • Problem

    Existing trustworthy AI research lacks a consolidated overview of its definitions, dimensions, computational methods, and future directions.

    Source: §1 · p. 2

  • Method

    The survey defines trustworthy AI, organizes six dimensions into taxonomies, reviews representative technologies and applications, and examines interactions among dimensions.

    Source: §1 · pp. 2–3, §11 · p. 40

  • Results

    The survey synthesizes computational approaches and identifies both accordance and tensions among trustworthy AI dimensions, including robustness–explainability alignment and fairness–environmental connections.

    Source: §9.1 · p. 38, §11 · p. 40

  • Takeaways & Limitations

    The survey provides a structured reference for understanding trustworthy AI technologies while highlighting interactions and research directions across its dimensions.

    Source: §1 · p. 2, §11 · p. 40

    Additional trustworthy AI dimensions remain less developed, with limited literature on computational methods.

    Source: §1 · p. 4

Abstract

from arXiv · show

In the past few decades, artificial intelligence (AI) technology has experienced swift developments, changing everyone's daily life and profoundly altering the course of human society. The intention of developing AI is to benefit humans, by reducing human labor, bringing everyday convenience to human lives, and promoting social good. However, recent research and AI applications show that AI can cause unintentional harm to humans, such as making unreliable decisions in safety-critical scenarios or undermining fairness by inadvertently discriminating against one group. Thus, trustworthy AI has attracted immense attention recently, which requires careful consideration to avoid the adverse effects that AI may bring to humans, so that humans can fully trust and live in harmony with AI technologies. Recent years have witnessed a tremendous amount of research on trustworthy AI. In this survey, we present a comprehensive survey of trustworthy AI from a computational perspective, to help readers understand the latest technologies for achieving trustworthy AI. Trustworthy AI is a large and complex area, involving various dimensions. In this work, we focus on six of the most crucial dimensions in achieving trustworthy AI: (i) Safety & Robustness, (ii) Non-discrimination & Fairness, (iii) Explainability, (iv) Privacy, (v) Accountability & Auditability, and (vi) Environmental Well-Being. For each dimension, we review the recent related technologies according to a taxonomy and summarize their applications in real-world systems. We also discuss the accordant and conflicting interactions among different dimensions and discuss potential aspects for trustworthy AI to investigate in the future.

1 INTRODUCTION

AI’s rapid societal impact is accompanied by safety, fairness, privacy, and other trustworthiness risks that hinder adoption. This survey addresses these concerns computationally across six dimensions, their interactions, and future research directions.

Motivation

  • AI’s vulnerabilities—including adversarial failures, discriminatory outputs, and privacy leakage—can cause severe safety, economic, and security consequences, making trustworthiness essential for wider adoption.Examples include altered road signs fooling autonomous vehicles, chatbots producing racist or sexist content, and feature vectors enabling fingerprint reconstruction.Source: §1 · p. 2

Survey contribution

  • The survey provides a comprehensive computational overview of trustworthy AI, defining its concepts, organizing six dimensions into taxonomies, reviewing representative algorithms, and distinguishing this perspective from legal or high-level reviews.It is intended to support newcomers’ understanding and help experienced researchers track recent progress.Source: §1 · p. 2

Survey scope

  • The six dimensions are Safety & Robustness, Non-discrimination & Fairness, Explainability, Privacy, Auditability & Accountability, and Environmental Well-Being.These dimensions are presented as the survey’s central framework for trustworthy AI.Source: §1 · pp. 2–3, Figure 1 · p. 3

Organization and future directions

  • The survey also covers third-party assessment and responsibility assignment, distinguishes trustworthy AI from related concepts, and identifies less-developed dimensions such as human agency and oversight for future research.Additional dimensions receive future-direction treatment because computational literature remains limited.Source: §1 · pp. 3–4

Dimension motivations

  • The survey motivates these dimensions through risks including perturbation-sensitive safety systems, discriminatory recognition, opaque medical diagnosis, memorized personal information, and energy-intensive AI models.Training BERT is reported to emit around 1,400 pounds of carbon dioxide, comparable to a round-trip trans-America flight.Source: §1 · pp. 3–4

Dimension interactions

  • Trustworthy-AI dimensions can reinforce or conflict with one another: robustness and explainability may be connected, while adversarial defenses can increase vulnerability to membership-inference attacks.The latter trade-off raises the risk of training-data leakage.Source: §1 · p. 4

2 CONCEPTS AND DEFINITIONS

The survey defines trustworthy AI as human-like problem-solving systems that benefit people without threatening or harming them, assessed through technical, user, and social perspectives. These perspectives encompass interconnected properties and overlap with related concepts such as ethical, beneficial, responsible, explainable, and fair AI.

Definition

  • Trustworthy AI comprises systems that solve problems like humans while delivering benefits and convenience without threatening or harming people.The definition is framed across technical, user, and social perspectives, summarized in Table 1.Source: §2 · p. 5, Table 1 · p. 5

Technical perspective

  • Technical trustworthiness requires accurate outputs, robustness to irrelevant environmental changes, human-understandable explanations, and transparency.These properties aim to reduce potential risks and harm in complex, volatile deployment environments.Source: §2 · p. 5

User perspective

  • User-centered trustworthiness requires availability, usability, safety, privacy protection, and human control over AI decision-making power.Systems should prioritize user safety, handle stored data carefully, and allow people to grant or withdraw autonomy.Source: §2 · p. 5

Social perspective

  • Social trustworthiness requires legal compliance, ethical conduct, nondiscrimination, fairness, accountability, and environmental friendliness.Accountability clarifies responsibility for each system component, while environmental responsibility includes limiting energy consumption and pollution.Source: §2 · pp. 5–6

Related terminologies

  • Ethical AI, beneficial AI, responsible AI, explainable AI, and fair AI overlap with trustworthy AI but differ in emphasis and scope.All seek reliable AI that sustainably benefits society, whereas trustworthy AI primarily emphasizes principles of the AI technology itself; the relationships are illustrated in Fig. 2.Source: §2 · pp. 6–7, Figure 2 · p. 7

3 SAFETY & ROBUSTNESS · 3.1 Concepts and Taxonomy · 3.2 Victim Models

This section frames safety and robustness as the ability to maintain stable, accurate performance under diverse conditions despite adversarial perturbations. It organizes adversarial robustness by threat models and victim models, spanning traditional and deep learning systems alongside corresponding defense strategies.

3 SAFETY & ROBUSTNESS

  • Adversarial perturbations can fool traditional classifiers and CNNs, GNNs, and RNNs, creating serious risks for authentication, autonomous driving, recommendation, and healthcare systems.The section motivates adversarial-robustness research as essential for safe and reliable machine learning in safety-critical applications.Source: §3 · p. 7

3.1 Concepts and Taxonomy

  • Threat models classify attacks by timing, attacker knowledge, and adversary goals, providing the taxonomy used to organize adversarial attacks and defenses.The section covers concepts of robustness, attack design, defense strategies, real-world effects, tools, surveys, and future directions.Source: §3.1.1 · p. 7, §3.1 · p. 7, §3 · p. 7

3.1.1 Threat Models.

  • Poisoning attacks modify training data, including backdoor triggers that induce target labels, whereas evasion attacks perturb test inputs to cause incorrect predictions.A panda image classified correctly can be changed by a perturbation and classified as a gibbon; poisoning is especially concerning when attackers can access collected training data.Source: §3.1.1 · pp. 7–8, Figure 3 · p. 8
  • White-box attacks exploit model architecture, parameters, and gradients, while black-box attacks query outputs and approximate gradients, making them more practical under real-world privacy constraints.White-box attacks are often formulated as gradient-based optimization problems, whereas black-box attackers lack model knowledge.Source: §3.1.1 · p. 8
  • Targeted attacks seek a specified label or misleading outcome for selected entities, whereas non-targeted attacks seek any prediction other than the correct one.For graph data, targeted attacks may mislead groups of nodes without forcing one particular prediction.Source: §3.1.1 · p. 8

3.2 Victim Models.

  • Victim models vulnerable to adversarial attacks range from Naive Bayes, SVM, and fully connected networks to CNNs, GNNs, and RNNs.Tree-based model robustness remains an open problem, while studies report significant degradation in GNN node classification after modifying features, edges, or nodes and use semantic or phonetic substitutions against text models.Source: §3.2 · pp. 8–9
  • Defense strategies include adversarial training with crafted samples, certified robustness within perturbation bounds, and inference-time detection that rejects harmful adversarial examples.These countermeasures operate during training, across bounded perturbations, or at inference time, respectively.Source: §3.2 · p. 9

3.3 Representative Attack Methods

Representative attacks are divided into test-time evasion attacks and training-time poisoning attacks, with evasion methods distinguished by perturbation constraints and poisoning methods by how adversaries manipulate training or trigger behavior. The survey highlights norm-bounded and alternative-distance evasion methods alongside poisoning and backdoor mechanisms that can preserve normal behavior on clean inputs.

3.3.1 Evasion Attack.

  • Evasion attacks occur at test time and constrain perturbations using fixed l_p norms or alternative distance measures to maintain small or perceptually similar changes.Alternative approaches include minimal l_p perturbations [97] and Wasserstein-distance measurements.Source: §3.3.1 · pp. 9–10
  • Norm-bounded evasion methods include PGD [229], which uses projected gradient ascent, and AutoAttack [98], which combines four attacks for more reliable robustness evaluation.AutoAttack combines three white-box attacks and one black-box attack.Source: §3.3.1 · pp. 9–10

3.3.2 Poisoning Attacks.

  • Poisoning attacks manipulate training data: poisoning frog inserts an adversarial image with its true label to misclassify target test samples, while backdoor triggers [78] cause target predictions on triggered inputs despite normal natural-sample behavior.Source: §3.3.2 · p. 10

3.4 Representative Defense Methods · 3.5 Applications in Real Systems

The paper surveys representative defenses against adversarial examples and shows that such attacks can compromise safety-critical systems across image, text, audio, and graph applications. Defenses include optimization, certification, detection, and practical techniques, but remain limited by robustness trade-offs, computational cost, evasion, and incomplete evaluation.

3.4.1 Robust Optimization / Adversarial Training.

  • Adversarial training formulates robustness as minimizing worst-case loss around training samples, but incurs longer training, natural–robust accuracy trade-offs, and robust overfitting.TRADES adds a regularizer to balance natural and robust accuracy, while gradient estimates for later layers can reduce training to one-fourth of GPU time or less with comparable robust performance.Source: §3.4.1 · p. 10
  • Early stopping, weight decay, and data augmentation are explored to mitigate robust overfitting, with data augmentation identified as a promising way to improve adversarial training.These methods address limitations that remain after the core min-max training procedure.Source: §3.4.1 · p. 11

3.4.2 Certified Defense.

  • Certified defenses seek provable robustness to norm-bounded perturbations, but randomized smoothing requires substantially greater computational resources in practice.Unlike empirical defenses, certified verification aims to determine exactly whether an adversarial example exists within a specified perturbation bound.Source: §3.4.2 · p. 11
  • Adversarial detection uses auxiliary classifiers, distributional tests such as MMD, or query-history thresholds, yet evasion attacks can bypass detectors and expose insufficient security evaluation.There is no clear evidence that adversarial samples are intrinsically different from clean samples, motivating black-box detection based on attacker intent.Source: §3.4.3 · p. 11

3.5.1 Image Domain.

  • Small adversarial modifications can make road-sign systems misread 35 mph as 85 mph or miss stop signs, while glasses and adversarial clothing can defeat face and person recognition.These attacks demonstrate concrete risks in autonomous driving, authentication, and person detection; the stop-sign failure is shown in Figure 4.Source: §3.5.1 · p. 11, Figure 4 · p. 12

3.5.2 Text Domain.

  • Adversarial attacks affect translation, text classification, and dialogue generation through paraphrases or black-box trigger inputs that preserve the targeted response’s semantics.Translation attacks search paraphrases greedily, with gradient guidance improving efficiency; dialogue attacks relax exact-response matching while retaining semantic identity.Source: §3.5.2 · pp. 11–12

3.5.3 Audio Data.

  • A small inaudible perturbation can make DeepSpeech transcribe arbitrary targeted phrases, while gradient-based audio attacks can evade YouTube’s copyright detection by altering music fingerprints.The attacks manipulate either the recognized speech waveform or the extracted fingerprint used for copyright matching.Source: §3.5.3 · p. 12
  • Graph attacks modify node connections, node features, or graph structure to degrade GCN classification, node embeddings, and downstream link prediction.Pro-GNN defends by jointly learning a clean adjacency matrix and GNN under low-rank, norm, and feature-smoothness constraints.Source: §3.5.4 · p. 12

3.6 Surveys and Tools · 3.7 Future Directions

This section catalogs surveys and tools for adversarial robustness, spanning multiple domains and practical evaluation resources. It also identifies unresolved challenges in attacks, adversarial training, and certified defenses.

3.6 Surveys and Tools

  • The surveys and tools subsection provides accessible resources for understanding, implementing, and evaluating adversarial robustness.The subsection explicitly aims to help readers access current surveys and tools.Source: §3.6 · p. 13

3.6.1 Surveys.

  • Xu et al. survey adversarial robustness concepts and representative attacks and defenses across image classification, graph classification, and natural language processing.Their coverage is complemented by domain-specific surveys for computer vision [24] [70], graphs [178], and natural language processing.Source: §3.6.1 · p. 13
  • Advertorch [112] provides a PyTorch toolbox of popular image-domain attack methods, while DeepRobust [212] offers image- and graph-domain attacks, defenses, and evaluation functions.DeepRobust is described as comprehensive and up to date.Source: §3.6.2 · p. 13
  • RobustBench [96] evaluates adversarially trained models with AutoAttack and provides pretrained robust models that reduce researchers’ resource requirements.The platform supports robust evaluation and offers models trained with different adversarial training methods.Source: §3.6.2 · p. 13

3.7 Future Directions

  • Future work seeks general adversarial attacks, fewer-query black-box generation, and models robust to adversarial examples beyond different l_p-bound attacks.These goals address broader robustness evaluation and attack coverage.Source: §3.7 · p. 13
  • Adversarial training remains challenged by robust overfitting and poor generalization on both adversarial and natural examples.The passage describes this problem as unresolved and requiring further improvement.Source: §3.7 · p. 13
  • Certified defenses need more efficient training because current methods require substantial computational resources to provide robustness guarantees.Improving training efficiency is presented as a possible future direction.Source: §3.7 · p. 13

4 NON-DISCRIMINATION & FAIRNESS

This section surveys AI non-discrimination and fairness, defining bias and fairness, classifying bias sources and types, reviewing mitigation methods and real-world applications, and identifying tools and future challenges. It emphasizes that fairness research must address widespread discriminatory behavior while balancing performance, precise definitions, and equity.

4 NON-DISCRIMINATION & FAIRNESS

  • AI systems can produce discriminatory content and unfair decisions across interactions, recidivism prediction, job recommendations, and dialogue generation, motivating systematic fairness research.Examples include Tay’s racist and sexist comments, higher recidivism risk scores for similarly profiled African Americans, and fewer STEM recommendations for women.Source: §4 · p. 13

4.1 Concepts and Taxonomy

  • Discriminatory bias differs from productive and erroneous bias, and can arise during data annotation, collection, processing, algorithm design, or evaluation.Bias may be explicit or implicit, while acceptable bias is explainable and unacceptable bias cannot be appropriately justified.Source: §4.1.1 · pp. 14–15

4.1.2 Fairness.

  • Fairness requires absence of prejudice or favoritism, including group criteria such as Equal Opportunity, Equal Odds, and Demographic Parity, and individual similarity-based treatment.Individual fairness requires |f_M(i) − f_M(j)| < ε for similar individuals under metric δ.Source: §4.1.2 · p. 15

4.2 Methods

  • Debiasing methods intervene before training through data changes, during training through reweighting, regularization, adversarial learning, or bandits, or after training through output transformations.These approaches can require training-data access and may balance fairness against predictive performance or calibration.Source: §4.2 · pp. 15–16, Table 2 · p. 16

4.3 Applications in Real Systems

  • Bias appears across tabular, image, text, audio, and graph systems, including demographic disparities in prediction, recognition, embeddings, language generation, voice processing, and graph representations.Reported examples include darker-face recognition disparities, gender stereotypes in embeddings and translation, male-favored voice recognition, and graph neural networks amplifying training bias.Source: §4.3 · p. 16, Table 3 · p. 17, §4.3.1 · p. 17

4.4 Surveys and Tools

  • Surveys, datasets, metrics, repositories, and audit toolkits such as Responsibly, FairTest, AIF360, Aequitas, and Fairness Measurements support fairness research and evaluation.Future work must clarify fairness concepts, understand fairness–performance trade-offs, and extend equality-focused definitions toward equity.Source: §4.4 · p. 18, §4.4.1 · p. 18, §4.4.2 · p. 19

5 EXPLAINABILITY

Explainability is central to trustworthy AI because increasingly complex, opaque models cannot be fully trusted in critical applications without understanding how they make decisions. This section presents explainability concepts, a taxonomy of explanation techniques, representative methods, applications, surveys, tools, and future opportunities.

5 EXPLAINABILITY

  • Explainability is needed to understand how opaque deep models make decisions, particularly before deploying them in ethically, medically, or safety-critical applications.Deep learning improved predictive performance through greater complexity but is often treated as a black box.Source: §5 · pp. 19–20

5.1.1 Concepts.

  • Explainability generally means presenting an AI decision in terms humans can understand [114] or clarifying the degree to which they understand its cause.Explainability and interpretability are often used interchangeably, although some studies distinguish them [144] [366].Source: §5.1.1 · p. 20
  • Interpretable models are intrinsically transparent, whereas explainable models remain opaque and use post hoc techniques that may be unreliable or misleading.Decision trees and linear regression exemplify interpretable models, while deep neural networks commonly require post hoc explanations.Source: §5.1.1 · p. 20

5.1.2 Taxonomy. •

  • Explanation techniques are classified by model usage as model-intrinsic or model-agnostic and by scope as local explanations for instances or global explanations for whole models.Model-intrinsic techniques are restricted to specific architectures, whereas model-agnostic techniques can apply to every possible algorithm.Source: §5.1.2 · p. 20

• Differences in the methodology:

The paper organizes explainability methods by model usage, explanation scope, and algorithmic methodology, covering intrinsic and model-agnostic approaches, local and global explanations, gradient- and perturbation-based techniques, and counterfactual explanations. It also surveys applications, tools, and open challenges including security, evaluation, and explaining black-box systems.

5.2.4 Explanation via Other Approaches: Counterfactual Explanations.

  • Counterfactual explanations are generally model-agnostic, local, and contrastive, describing how minimal feature changes could shift an instance’s prediction to a desired outcome.Wachter et al. formulate counterfactual generation as constrained optimization balancing prediction distance against feature-value distance.Source: • Differences in the methodology · p. 21, §5.2.3 · p. 25, §5.2.4 · p. 25

5.2.1 Model usage.

  • Explainability methods are classified by model usage into intrinsic white-box models and flexible model-agnostic methods for interpreting complex black-box systems.Intrinsic models include linear or logistic regression, decision trees, rule-based models, GAMs, and Bayesian networks; model-agnostic methods include LIME and GNNExplainer.Source: §5.2.1 · pp. 21–23

5.2.2 Scope of Explanation.

  • Explanation scope separates local methods that attribute a single prediction from global methods that summarize model behavior across inputs or labels.Saliency maps illustrate local pixel importance, while decision trees and class-model visualization provide global insight into model behavior.Source: Figure 5 · p. 21, §5.2.2 · pp. 23–24

5.2.3 Differences in the methodology.

  • Gradient-based methods compute input attributions from partial derivatives during back-propagation, whereas perturbation-based methods vary inputs and infer feature importance from model responses.CAM and Grad-CAM highlight image regions using gradients; perturbations may replace, blur, shift, or mask features, as in SHAP’s feature-removal framework.Source: • Differences in the methodology · p. 20, §5.2.3 · pp. 24–25

5.3.1 Recommender Systems.

  • Explainability supports recommender systems by making personalized recommendations more transparent, motivating user interaction, improving decisions, and increasing trust.RuleRec [227] induces interpretable item-association rules, while another approach combines gradient-boosted decision trees with an interpretable attention network.Source: §5.3.1 · p. 26

5.3.2 Drug discovery.

  • Explainable AI is applied across drug discovery and NLP, including identifying mutagenic molecular groups, interpreting toxicophore-like structures, selecting clinical-text segments, and explaining text-classification predictions [226] [251].These applications address the reduced explainability of high-performing deep-learning models in language and molecular analysis.Source: §5.3.2 · p. 26, §5.3.3 · pp. 26–27

5.4 Surveys and Tools.

  • Surveys and open-source toolkits provide resources for studying and implementing explainability, including AIX360, InterpretML [256], DeepExplain [26], and DIG [219].The toolkits cover intrinsic and black-box methods, evaluation metrics, educational materials, gradient- and perturbation-based techniques, and graph deep learning.Source: §5.4.1 · p. 27, §5.4.2 · p. 27

5.5 Future Directions

  • Future research must improve explanation security, develop less subjective qualitative and quantitative evaluation methods, and enable explanations when target models are black boxes.Adversarial examples can deceive both classifiers and their interpreters, while privacy and security concerns may limit access to target-system knowledge.Source: §5.5 · pp. 27–28

6 PRIVACY

The privacy section frames privacy-preserving machine learning as a response to risks that sensitive data and models may expose, organizing attacks, defenses, applications, resources, and future challenges. It emphasizes confidential computing, federated learning, and differential privacy while noting unresolved deployment, efficiency, scalability, and privacy–utility trade-offs.

6 PRIVACY

  • Privacy-preserving machine learning addresses exposure of sensitive data and models through principled attacks, defenses, applications, surveys, tools, and future directions.The section motivates privacy protection through legal regulations including CCPA, HIPAA, and GDPR.Source: §6 · p. 28

6.2.1 Privacy Attack.

  • Privacy attacks include membership inference, model inversion, property inference, and model extraction, targeting training data, inputs, population properties, or confidential model information.Membership inference can reveal whether records such as medical or credit-card data were used for training; model inversion can reconstruct sensitive genetic or facial information; extraction can convert black-box access into white-box access.Source: §6.2.1 · pp. 29–30

6.2.2 Privacy Preservation.

  • The three main privacy-preservation directions are confidential computing, federated learning, and differential privacy, which protect data during computation, avoid raw-data transmission, or mask individual contributions.Confidential computing includes TEEs, MPC, and HE; federated learning keeps data decentralized; differential privacy adds uncertainty while retaining aggregate utility.Source: §6.2.2 · pp. 30–31, Figure 12 · p. 30
  • Federated learning collaboratively trains models across clients without transmitting private data, but its efficiency and effectiveness remain challenging under non-IID data distributions and large-scale heterogeneous deployment.A typical round selects clients, broadcasts the model, performs local computation, aggregates updates, and repeats until accuracy or performance requirements are met.Source: §6.2.2 · pp. 31–32, §6.5 · p. 33

6.3 Applications in Real Systems

  • Privacy-preserving techniques support healthcare, biometric-data, and recommender applications by combining federated learning, confidential computing, differential privacy, secure aggregation, and noisy or differentially private training.These methods address healthcare-data sharing constraints, non-revocable biometric information, recommender-system inference risks, and recovery of client data from gradients or model updates.Source: §6.3.1 · p. 32, §6.3.2 · p. 32, §6.3.3 · p. 32

6.4 Surveys and Tools

  • Surveys cover privacy-preserving machine learning, federated learning, and differential privacy, while available tools include TFF, FATE, FedML, Opacus, TensorFlow-Privacy, OpenDP, Keystone Enclave, and MPC/HE repositories.The surveyed resources support further exploration and implementation of privacy-preserving systems.Source: §6.4.1 · p. 33, §6.4.2 · p. 33

6.5 Future Directions

  • Future work must improve confidential-computing efficiency and flexibility, federated-learning scalability and effectiveness, differential-privacy utility, and integration across techniques for versatile trustworthy systems.The section states that these approaches remain far from extensive use and require continued development.Source: §6.5 · p. 33

7 ACCOUNTABILITY & AUDITABILITY

Accountability assigns responsibility for AI impacts, while auditability evaluates theories and implementation processes to support trustworthy systems. The section distinguishes accountability roles, external and internal audits, existing tools, and future directions for auditing dynamic AI systems.

7 ACCOUNTABILITY & AUDITABILITY

  • Accountability is difficult because opaque, complex AI systems involve data, algorithms, implementation, and human control, yet responsibility remains necessary for trustworthy deployment.Auditability provides principled evaluations of algorithm theories and implementation processes to help guarantee accountability.Source: §7 · p. 33

7.1 Concepts and Taxonomy

  • Accountability requires distributing responsibility across system designers, decision-makers, deployers, auditors, and end users according to their roles and obligations.The distribution should distinguish harms caused while an AI system works correctly from harms caused by improper operation [352].Source: §7.1.1 · p. 34

7.1.1 Accountability.

  • Audits are principled, independent evaluations of software products and processes against applicable regulations, standards, guidelines, plans, specifications, and procedures.Auditability is presented as a central methodology for ensuring accountability.Source: §7.1.2 · p. 34

7.1.2 Auditability.

  • External audits provide independent perspectives and objective reports but often lack access to training data and implementation details, and occur after deployment when remediation may be costly or harm may have occurred.They are conducted by third parties independent of system designers and deployers.Source: §7.1.2 · pp. 34–35
  • Internal audits access extensive internal data, can occur before deployment, and inform decisions, but shared interests with the audited organization can undermine objectivity.SMACTR structures internal auditing into scoping, mapping, artifact collection, testing, and reflection.Source: §7.1.2 · p. 35

7.2 Surveys and Tools

  • Algorithmic-accountability surveys define the concept through prior accountability literature, while tools for safety, fairness, explainability, privacy, and environmental well-being can also support algorithm auditing.These resources are summarized to help readers explore accountability and auditability.Source: §7.2.1 · p. 35, §7.2.2 · p. 35, §7.2 · p. 35

7.3 Future Directions

  • Future auditing should combine external and internal audits, strengthen explainability, and audit AI systems periodically while updating principles as inputs and environments change.Understanding system theory and mechanisms supports reliable use and well-recognized responsibility distribution.Source: §7.3 · p. 35

8 ENVIRONMENTAL WELL-BEING

Trustworthy AI must address the substantial environmental burden of developing and deploying AI, especially energy consumption and its associated carbon emissions. The survey reviews energy-reduction methods, real-system assessment approaches, surveys, tools, and future research directions.

8 ENVIRONMENTAL WELL-BEING

  • Training a common NLP pipeline can emit as much carbon as one human produces in seven years, while training and fine-tuning a large Transformer uses five times a car’s lifetime energy.These costs add to energy use from infrastructure such as data-center cooling, motivating environmental well-being as a trustworthy-AI concern.Source: §8 · p. 35

8.1.1 Model Compression.

  • Model compression reduces storage and training or deployment energy with acceptable performance loss, using pruning, quantization, factorization, compact filters, distillation, and parameter sharing across vision and language models.These techniques have been applied to CNNs, Transformer, and BERT models.Source: §8.1.1 · p. 36
  • Adaptive design improves efficiency by pruning the most energy-consuming layers first or optimizing CNN architectures under energy constraints through Bayesian hyperparameter optimization.These approaches treat architecture design as an energy-saving problem rather than relying only on fixed model structures.Source: §8.1.2 · p. 36

8.1.2 Adaptive Design.

  • Hardware-level approaches use DNN accelerators and specialized devices for neurons, sparse networks, RNN speech recognition, and GANs to improve training and inference efficiency.Examples include NPUs, RENO, sparse-neural-network hardware, dedicated RNN engines, and ReGAN.Source: §8.1.3 · p. 37

8.2 Applications in Real Systems

  • Real-system studies estimate and evaluate energy use across computer vision and NLP, including layer-level CNN analysis, NeuralPower’s power and runtime predictions, energy-precision tradeoffs, and carbon measurements for Transformer, ELMo, and GPT-2 [312].The energy-precision ratio helps developers balance energy consumption against model performance when selecting CNN architectures.Source: §8.2 · p. 37

8.3 Surveys and Tools

  • Surveys organize energy-estimation, model-compression, processor-efficiency, GPU-efficiency, and DNN-accelerator research by methods, categories, performance, applications, strengths, and weaknesses.Representative surveys include García-Martín et al., Cheng et al. [81], Wang et al., Mittal and Vetter [245], and.Source: §8.3.1 · p. 37

8.3.1 Surveys.

  • Energy and emissions tools include SyNERGY for measuring and predicting CNN energy consumption, the Machine Learning Emissions Calculator [201] for quantitatively estimating training carbon emissions, and Accelergy and Timeloop for DNN accelerator energy estimation.Source: §8.3.2 · pp. 37–38

8.4 Future Directions

  • Future work should make AutoML prioritize energy savings and develop customized training hardware, since current AutoML often prioritizes performance and accelerators emphasize inference while overlooking training.The survey identifies energy-aware model design and efficient training devices for diverse DNNs as practical directions.Source: §8.4 · p. 38

9 INTERACTIONS AMONG DIFFERENT DIMENSIONS

Trustworthy AI dimensions can reinforce one another or conflict, so achieving them may require leveraging accordances or making context-dependent trade-offs. The section illustrates these interactions through examples involving robustness, explainability, fairness, privacy, and environmental well-being.

9 INTERACTIONS AMONG DIFFERENT DIMENSIONS

  • The six trustworthy AI dimensions are interdependent: satisfying one can promote another, while conflicts may make simultaneous satisfaction impossible and require trade-offs.Understanding these interactions can provide alternative ways to achieve a dimension through another dimension or guide compromises when requirements conflict.Source: §9 · p. 38

9.1 Accordance

  • Robustness and explainability can reinforce each other: robust training improves saliency-map interpretability, while interpretation regularization improves robustness to adversarial attacks.Etmann et al. [122] mathematically connect Lipschitz regularization with gradients aligning to inputs, and Noack et al. propose Interpretation Regularization for explainable gradients.Source: §9.1 · p. 38
  • Reducing the environmental cost of large-model training can support fairness by easing unequal access to high-performance computing resources.Large models’ computing demands harm the environment and aggravate inequality among AI researchers who cannot afford comparable hardware [312].Source: §9.1 · p. 38

9.2 Conflict

  • Robustness can undermine privacy because adversarially defended models may overfit to training data, increasing exposure to membership inference attacks.Song et al. report that robust-training approaches make sensitive training information easier to detect from model outputs.Source: §9.2 · p. 39
  • Adversarial training can improve robustness while creating significant performance and robustness disparities across groups, motivating Fair-Robust-Learning (FRL) [344].This disparity can arise even when datasets are balanced, making robustness improvements come at the expense of fairness.Source: §9.2 · p. 39
  • Differential privacy and exact equal-opportunity fairness are theoretically unlikely to coexist, although approximate fairness can be achieved by relaxing the requirement.Cummings et al. establish the incompatibility result for classification models and show that a classifier satisfying both differential privacy and approximate fairness is possible.Source: §9.2 · p. 39

10 FUTURE DIRECTIONS

The survey identifies additional trustworthy-AI dimensions for future study, emphasizing human autonomy, content credibility, and interactions among dimensions.

10 FUTURE DIRECTIONS

  • Future work should expand trustworthy AI beyond the six dimensions surveyed to examine additional underexplored dimensions.The section introduces several potential dimensions that have not received extensive attention.Source: §10 · p. 39

10.1 Human agency and oversight

  • Human autonomy requires human-centered AI that preserves independent decision-making and oversight throughout the system life cycle.Human agency supports understanding, evaluating, and challenging AI decisions, while oversight can use human-in-the-loop, human-on-the-loop, and human-in-command strategies.Source: §10.1 · p. 39

10.2 Creditability

  • AI systems should incorporate mechanisms that ensure the credibility of generated or screened content, because misinformation undermines trust.Users increasingly rely on outputs from QA agents and recommender systems, but their integrity is not guaranteed.Source: §10.2 · pp. 39–40

10.3 Interactions among Different Dimensions

  • Research should investigate how trustworthy-AI dimensions interact across scenarios, including whether interpretability promotes fairness or creates group disparities.These interactions may be accordant or conflicting, and understanding them is important for building trustworthy AI systems.Source: §10.3 · p. 40

11 CONCLUSION

The survey provides a comprehensive computational overview of trustworthy AI, defining it across six dimensions and examining their technologies, applications, interactions, and future directions.

11 CONCLUSION

  • The survey organizes trustworthy AI around six dimensions: Safety & Robustness, Nondiscrimination & Fairness, Explainability, Accountability & Auditability, Privacy, and Environmental Well-being.It distinguishes trustworthy AI from related concepts and presents taxonomies, representative technologies, applications, surveys, tools, and future research directions for each dimension.Source: §11 · p. 40
  • The survey analyzes both accordant and conflicting interactions among the six trustworthy-AI dimensions.Source: §11 · p. 40
  • The conclusion identifies additional potential trustworthy-AI dimensions beyond the six surveyed as future research directions.Source: §11 · p. 40

Related papers

Loading 2107.06641v3…