# Resilience and Resilient Systems of Artificial Intelligence: Taxonomy, Models and Methods
## 5 Models and Methods to Ensure and Assess AIS Resilience
### Proactivity and Robustness
A similar effect can be achieved by redistributing the knowledge among multiple neurons and weights, reducing the importance of individual neurons. This redistribution can be performed by including a regularization (penalty) term in the loss function to indirectly incorporate faults in conventional algorithms. Redundancy methods have traditionally been used in reliability theory to ensure fault tolerance. Similarly, duplication of critical neurons and synapses and model ensembles are used in neural networks. Error detection is another approach to fault handling which provides Rejection Option in the presence of neural weight errors caused by faults. In [90; 92], sum checking and low-collision hash function are proposed in order to detect changes in the \begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline
**Approach** & **Capability** & **Weakness** & **Methods and Algorithms** \\ \hline \multirow{6}{*}{Gradient masking} & \multirow{6}{*}{Perturbation absorption} & \multirow{6}{*}{Vulnerability to attacks based on gradient approximation or block-box optimization with evolution strategies} & Non-differentiable input transformation [65; 66] \\ \cline{3-5}  & & & Vulnerability to attacks based on gradient approximation or block-box optimization with evolution strategies & Defensive distillation [67] \\ \cline{3-5}  & & & & Models selection from a family of models [68] \\ \cline{3-5}  & & & & Generative model PixelDefend or Defense-GAN [69; 70] \\ \hline \multirow{6}{*}{Robustness optimization} & \multirow{6}{*}{Perturbation absorption and performance recovery} & \multirow{6}{*}{Significant computational resource consumption to obtain a good result} & Adversarial retraining [80] \\ \cline{3-5}  & & & Stability training [72] \\ \cline{3-5}  & & & Jacobian regularization [73] \\ \cline{3-5}  & & & Sparse coding-based representation [75] \\ \cline{3-5}  & & & Intra-concentration and inter-separability regularization [30; 31; 74] \\ \cline{3-5}  & & & Provable defenses with the Reluplex algorithm [81] \\ \hline \multirow{6}{*}{Detecting adversarial examples} & \multirow{6}{*}{Rejection Option in the presence of adversarial inputs with the subsequent AI-decision explanation and passing the control to a human} & \multirow{6}{*}{Not reliable enough} & Light-weight Bayesian refinement [76] \\ \cline{3-5}  & & & Adversarial example detection using latent neighborhood graph [77] \\ \cline{3-5}  & & & Feature distance space analysis [82] \\ \cline{3-5}  & & & Training Data Sanitization algorithms based on Reject on Negative Impact approach [78] \\ \hline \end{tabular}
\end{table} 
Table 2: Approaches and algorithms to ensure the recognition and absorption of adversarial attacks. neural network weight under the influence of memory faults. In the paper [91], the current value of the contrastive loss function for the diagnostic data is compared with a reference value for fault detection. The reference value is calculated as contrastive loss value on the test diagnostic data samples under normal conditions. Table 4 shows the approaches used to detect and mitigate concept drift. Out-of-domain generalization and Ensemble selection are two main approaches for absorbing small concept drifts. Out-of-domain generalization can be achieved by using domain randomization [93] and adversarial domain augmentation [94], building Domain-invariant representation [95] or Heterogeneous-domain knowledge propagation [96]. In [93; 94], domain randomization and adversarial domain augmentation, which increase the robustness of the model under bounded data distribution shifts, are proposed. Domain randomization is the generation of synthetic data with large enough variations so that that real-world data are simply viewed as another domain variation [93]. Adversarial domain augmentation creates multiple augmented domains from the source domain by leveraging adversarial training with relaxed domain discrepancy constraint based on the Wasserstein auto-encoder [94].