Fine-tuning-related

Cost-inducing training of AI models specifically for malicious use

AI models can be designed to make further post-training modifications (e.g., fine-tuning) too costly for malicious uses while preserving normal adaptability for non-malicious uses [88, 56].

Restrict web access during AI training

Developers can restrict or disable AI systems’ internet access during training. For example, developers can restrict web access to read-only (e.g., by disabling write-access through HTTP POST requests and access to web forms) or limit the access of the AI system to a local network [20].

Adversarial training

Adversarial training [83] is a technique for training AI models in which adversarial inputs are generated for a model, and the model is then trained to give the correct outputs for those adversarial inputs. Adversarial training can involve adversarial examples generated by human experts, human users, or other AI systems.

Robustness certificates

A model can be certified to withstand adversarial attacks given specific datapoint constraints, model constraints, and attack vectors [156, 124]. Certification means that it can be both analytically proven and shown empirically that the model will withstand such attacks up to a certain threshold. Currently, robustness certification methods are limited to certifying against attacks via manipulation of pixels on specific ℓ p norms, canonically the ℓ 2 (Euclidean) norm, up to a certain neighborhood radius.

Calibrated confidence measures for model predictions

Incorporating calibrated confidence measures alongside a model’s predictions and standard performance metrics, such as accuracy, can help users identify instances of overconfidence in incorrect predictions or underconfidence in correct ones [85]. These additional measures can provide users with more information to better interpret the model’s decisions and assess whether its predictions can be trusted

Incorporating the estimation of atypical input samples or classes for better model reliability

Incorporating the estimation of rare atypical input samples or classes might improve a model’s reliability, both with respect to its predictions and confidence calibration. Model predictions for rare inputs and classes may have a tendency of being overconfident and have worse accuracy scores [232]. For LLMs, the negative log-likelihood can be used as an atypicality measure. For discriminative models, Gaussian Mixture Models can be employed to estimate conditional and marginal distributions, which are then used in atypicality measurement.