# Privacy-Preserving and Explainable AI in Industrial Applications
## 4 Industrial Impact and Remaining Challenges
### Remaining Challenges
#### 4.2.2 Robustness  
Robustness refers to the property that characterizes how effective the AI model is when being tested on a new independent dataset. Specifically, robustness can be linked to the topic of confidence and out-of-distribution detection. It is known that the output of classic deep neural networks may be unreliable when applied on out-of-domain, noisy, or uncertain input data. Many methods have been proposed for assessing model output confidence. Normalizing flows (NFs) are a family of generative models with tractable distributions, where both sampling and density evaluation can be efficient and exact [73]. The goal is to model \(p(x)\), where \(x\) denotes samples from a training set and \(p(x)\) is the probability distribution. An NF model can answer the following question: given a new set of \(x\), how likely are they to be from the same \(p(x)\) distribution (as observed in the training set)? The NF framework employs two components: a bijective encoder (usually employing deep neural networks) and a prior probability distribution (usually a fixed multivariate normal distribution). In contrast with other methods such as variational inference (which only offer a lower bound of \(p(x)\) named \"evidence lower bound-ELBO\"), NFs are capable of fast density estimation, given a suitable choice of model architecture. In that aspect, coupling layers have recently been proposed [74; 75] which offer a simple and efficient mechanism for computation of both forward (for density estimation) and backward passes (for sampling). Training can be performed end-to-end in an unsupervised manner. An NF model can be deployed to detect out-of-distribution (OoD) input samples which should be excluded from the downstream deep neural network (DNN) pipeline. For example, given a model which was trained on a supervised task on a trainset T, an NF model can be trained on the same trainset. If, for new samples, the NF model computes low probability estimates, then those samples are outside the training manifold T of the supervised model, and its predictions may be regarded as unreliable. Another approach to OoD detection in multiclass classification tasks is to employ softmax logits to compute energy scores, which have been shown to be aligned with the probability density of the inputs and be less susceptible to the overconfidence issue [76]. This approach can distinguish between in- and out-of-distribution samples, even when employing out-of-the-box models which have not been specifically tuned for this purpose. Naturally, OoD detection can be improved by employing outliers and an additional loss term which encourages the network to maximize the separation between energy scores for true samples vs. outliers. They have also stated that \"methods relying on the softmax confidence score suffer from overconfident posterior distributions for OoD data\". This means that output softmax probabilities tend to be erroneously high for outliers. It is shown that a classification model having a softmax final activation implicitly contains an input density estimator. The energy score can also be incorporated into the training objective, along with the categorical cross-entropy classification loss. The training dataset would consist of two parts: (i) an in-distribution subset, on which the classification loss is computed, and for which the energy score is minimized, and (ii) an OoD subset, on which only the energy score is computed and maximized. The energy method is applicable to an already trained model, extending it as an OoD classifier. Moreover, fine-tuning energy scores during main training can boost OoD detection performance. Other approaches for analyzing and improving robustness is to use uncertainty estimation techniques. An established method for uncertainty quantification is to employ Gaussian processes (GPs). Figure 5 illustrates the performance of two methods using GPs for uncertainty quantification: red dots are the predictions, deep blue lines represent the label values, and light blue areas represent the certainty limits.