Operation infrastructure patterns

Continuous ethical validator

quire continual learning based on new data collected during operation of the AI system. The continuous ethical validator deployed in an AI system continuously monitors and validates the outcomes of AI components (e.g., the path recommended by the navigation system) against the ethical requirements [58, 111]. The outcomes of AI systems are about whether the AI system provides the intended benefits and behaves appropriately given the situation. The time and frequency of validation can be configured. Version-based feedback and rebuild alert are sent when the pre-defined conditions regarding the ethical requirement are met.

Ethical sandbox

Ethical sandbox can be applied to isolate an AI component from other AI components and non-AI components by running the AI component separately in a safe environment [63] (e.g., sandboxing the unverified visual perception component). Thus, the AI component could execute without affecting other components and the output of the AI system. The ethical sandbox is an emulated environment with no access to the rest of the AI system. An emulation environment duplicates all the hardware and software functionality of an AI system. Thus, developers could run an AI component safely to determine how it works and whether it is responsible before widely deploying the AI component. aximal tolerable probability of violating the ethical requirements should be defined as the ethical margin for the sandbox. A watchdog can be used to limit the execution time of the AI component to reduce the ethical risk (e.g., only activating the visual perception component for 5 minutes on the bridges built especially for autonomous vehicles).

Ethical Knowledge Base

An ethical knowledge base, such as a knowledge graph, makes meaningful entities and concepts, and their relationships in design, implementation, deployment, and operation of AI systems [32, 85, 101]. With the ethical knowledge base, the rich semantic relationships between entities are explicit and traceable across heterogeneous high-level documents on one hand and different artifacts across the AI system lifecycle on the other hand. Thus, ethical requirements of the AI system can be systematically accessed and analyzed using the ethical knowledge base

Ethical digital twin

Before running an AI system in the real world, it is important to perform system-level simulation through an ethical digital twin running on a simulation infrastructure to understand the behaviors of the AI system and assess ethical risks in a cost-effective way. Digital twin [102] was introduced by NASA as a digital representation of a real system used in lab-testing activities. The digital twin of an AI system could be used to represent the behaviors of the AI system and forecast change impacts. The ethical digital twin can also be used during operation of the AI system to assess the system’s runtime behaviors and decisions based on the simulation model using the real-time data. The assessment results can be sent back to alert the system or user before the unethical behavior or decision takes effect

Incentive registry

centive mechanisms are effective treatments in motivating AI systems and encouraging the stakeholders involved in the AI system ecosystem to execute tasks in a responsible manner. An incentive registry records the rewards that correspond to the AI system’s ethical behavior and outcome of decisions [121, 125] (e.g., rewards for path planning without ethical risks). There are various ways to formulate the incentive mechanism, such as using reinforcement learning or building the incentive mechanism on a publicly accessible data infrastructure like blockchain [125]. Traditional incentive mechanisms for human participants include reputation based and payment based.

Ethical black box

The purpose of embedding an ethical black box in an AI system is to investigate why and how an AI system caused an accident or a near miss. The ethical black box continuously records sensor data, internal status data, decisions, behaviors (both system and operator), and effects [33, 34, 122]. For example, an ethical black box could be built into an automated driving system to record the behaviors of the system and driver and their effects [34]. All of these data need to be kept as evidence with the timestamp and location data.

Global view auditor

The global-view auditor is a component that collects information from multiple AI components/AI systems and processes the information to identify discrepancies among the information collected [79]. Based on the result, the global-view auditor may alert the AI system/component to a wrong perception, thus avoiding negative impacts or identifing liability when negative events occur. This pattern can be also used to improve the decision making of an AI system by taking the knowledge from other systems. For example, an autonomous vehicle may increase its visibility using the perceptions of others to make better decisions at runtime. The global-view auditor enables accountability that covers different perceptions of AI components/systems that are involved and redresses the conflicting information collected from multiple AI components/systems.