# Resilience and Resilient Systems of Artificial Intelligence: Taxonomy, Models and Methods
## 5 Models and Methods to Ensure and Assess AIS Resilience  
### Proactivity and Robustness  
The proactivity of the AIS implies preparation for absorbing disturbances of a known type and predicting the beginning of the impact of known and unknown disturbances on the AIS performance. The ability of the AIS to absorb disturbances is related to the robustness of AIS models. The choice of the method for absorbing and recognizing (detecting) a disturbance depends on the type of disturbance. Table 2 presents the approaches and their corresponding methods and algorithms aimed at resistance to adversarial attacks. The first approach is Gradient masking, the simplest implementations of which are methods of special data preprocessing, such as jpeg compression, random padding and resizing [65; 66] defensive distillation [67], randomly choosing a model from a set of models or using dropout [68], the use of generative models [69; 70], and discrete atomic compression [71]. The second approach is to optimize the robustness at the preparatory stage of the resilient system's operating cycle. The most general and simplest method of optimizing robustness involves training on generated perturbed training samples combined with certain regularization methods [72; 73; 74]. These methods minimize the impact of small perturbations on the input data based on Jacobian regularization or L2-distance between feature representations for original and perturbed samples. Sparse coding-based methods of feature representation are also considered to be a method of optimizing robustness due to the low-pass filtering effect [75]. The latest approach is to detect adversarial evasion attacks in the test data and poisoning attacks in the training data [76; 77; 78]. However, [PERSON] and [PERSON] rigorously demonstrate that the properties of adversarial samples are difficult and resource-intensive to detect [79]. \begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**AIS Application Area** & **AIS Threat Examples** & **Consequences of the Lack of AIS Resilience** \\ \hline \multirow{7}{*}{Healthcare} & Adversarial modification of medical data can be used to manipulate patient billing [64]. & \\ \cline{2-3}  & An automatic e-health system for prescriptions can be deceived by adversarial inputs that are forged to subvert the model’s prediction [64]. & \\ \cline{2-3}  & Changes in treatment protocols, new diagnostic methods, and changes in demand for services may cause the trained diagnostic model to become outdated [64]. & \\ \cline{2-3}  & In addition, adversarial attacks on AI-based diagnostic system can also lead to concept drift. The concept drift, in turn, can lead to inaccuracies in prediction and incorrect diagnoses. & \\ \hline \hline \end{tabular}
\end{table} 
Table 1: _Cont._The analysis of Table 2 shows that, with enough computing resources, the most promising approach is based on robustness optimization. In addition, this approach is compatible with the use of other approaches, allowing to implement the principle of defense in depth. Table 3 shows the approaches which are used to ensure robustness to the injection of faults in the computing environment where neural networks are deployed: fault masking [83; 84; 85], the introduction of explicit redundancy [86; 87; 88] and error detection [89; 90; 91]. Faults are understood as accidental or intentional bit flips in memory, which store the weights or the output value of the neuron. Fault masking can be implemented in the form of architectural solutions that automatically correct or eliminate the impact of a small portion of neural weights' faults. Optimizing the architecture to increase robustness means minimizing the maximum error at the output of the neural network for a given number of bit-flips in neural weights or results of neural intermediate calculations. However, architecture optimization is traditionally a very resource-intensive process.