## 2 Background
### Trustworthiness Metrics  
Trustworthiness in ML models is a multifaceted concept that encompasses various aspects of reliability, fairness, and transparency [2]. To assess the trustworthiness of a model, several specific measures can be employed. Accuracy and precision quantify the model's ability to correctly predict outcomes. Accuracy measures the overall correctness of predictions, while precision focuses on the proportion of correct positive predictions. High accuracy and precision with a receiver operating characteristic (ROC) indicate a reliable model.  
* Fairness: Fairness measures assess whether the model treats different data groups equitably. This can be evaluated using metrics like disparate impact, which measures the ratio of the false positive rate for one group to the false positive rate for another group. A fair model should have a disparate impact close to 1.
* Explainability: In addition to interpretability, explainable models provide insights into their decision-making process, making them more transparent [32]. Metrics such as feature importance, SHAP [67; 68], partial dependency, and LIME [9; 69] values can be used to understand which features contribute most to the model's predictions. A trustworthy model should be explained to foster trust and accountability [5].
* Robustness: Robustness measures the model's ability to withstand adversarial attacks, which aim to deceive the model into making incorrect predictions [9; 24]. Techniques like adversarial training can be used to improve robustness. A trustworthy model should be resistant to such attacks. By exposing the model to these malicious inputs, it can identify vulnerabilities and evaluate its susceptibility to adversarial examples [70]. The model's performance is measured by comparing the percentage of misclassifications on the adversarial dataset, indicating the proportion of instances that escaped detection; a rigorous theoretical reasoning of this essential property is presented by [11]. This evaluation helps gauge the model's ability to withstand malicious attempts to manipulate its predictions.
* Privacy: Privacy measures assess how well the model protects user data. Metrics like differential privacy quantify the level of privacy protection. A trustworthy model should prioritize user privacy and avoid compromising sensitive information.  
\begin{table}
**Method** & **Description** & **Key Strengths** & **Key Weaknesses** & **Typical Use Cases** \\ \hline PGD (Projected Gradient Descent) & Iterative version of FGSM that refines adversarial examples by taking multiple small steps. & Very effective against both standard and moderately robust models. & Computationally intensive compared to FGSM. Requires careful tuning of step size (\(\alpha\)) and perturbations. & Benchmarks robustness against strong attacks. \\ PGCD (Projected Gradient Descent) & Iterative version of FGSM that refines adversarial examples by taking multiple small steps. & Very effective against both standard and moderately robust models. & \begin{tabular}{p{56.9 pt} p{56.9 pt} p{56.9 pt} p{56.9 pt}} \hline \hline \multirow{4}{*}{\begin{tabular}{} \end{tabular} } & \multirow{4}{*}{\begin{tabular}{} \end{tabular} } & \multirow{4}{*}{\
\begin{tabular}{} \end{tabular} } & \multirow{4}{*}{
\begin{tabular}{} \end{tabular} } \\  & & & & \\ \cline{1-1} \cline{5-5}  & & & & & \\ \cline{1-1} \cline{5-5}  
Untrustworthy ML models may have deficiencies in different areas. For example, a model with high accuracy but low fairness may perpetuate biases, leading to unfair outcomes. A model that is not explainable may be challenging to trust, as users cannot understand how decisions are made. A model that is vulnerable to adversarial attacks may be unreliable in real-world applications.