发表机构
Fraunhofer Institute for Cognitive Systems IKS; Technical University of Munich（弗劳恩霍夫认知系统研究所IKS; 慕尼黑工业大学）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
本文提出CUBICS框架，将运行设计域划分为情境，用主观逻辑以贝叶斯方式建模安全相关ML组件的情境特定保证，结合情境频率信念得出组件风险估计，为模块化安全保证提供基础。
AI 中文摘要
机器学习（ML）是当前推动创新的关键技术，但确保机器学习的安全性仍是安全相关应用的重大挑战。一个有前景的思路是从现场数据构建可验证的使用论证，例如以影子模式或安全包络内运行机器学习组件（MLC），使其输出可作为“安全探针”被监控而不影响安全性。这些探针随后可用于以贝叶斯方式构建关于现场性能的统计论证。然而，安全工程中许多基于现场数据的贝叶斯方法将故障建模为简单的伯努利（或二项）过程，采用单一全局故障概率和独立同分布试验，这对于性能强烈依赖情境的MLC而言极少适用。统计证据还涉及相关情境（包括边缘案例）的覆盖范围，为整个系统构建单一集成统计模型通常不可行。为应对这些挑战，本文提出CUBICS，一种面向安全相关机器学习组件的、针对每个组件的情境感知性能估计的上下文模块化框架。CUBICS将运行设计域划分为不同情境，针对每个安全相关组件，定义一组情境特定的假设和概率保证，这些保证使用主观逻辑（SL）以贝叶斯方式表示和更新。通过将这些保证与各情境发生频率的信念相结合，CUBICS可在无需整体系统级统计模型的情况下，得出每个组件的总体风险估计，从而为基于现场数据的模块化安全保证提供构建块。
英文摘要
Machine learning (ML) is a key technology driving innovation today, but ensuring ML safety remains a major challenge for safety-related applications. A promising idea is to build proven-in-use arguments from field data, e.g. by running ML components (MLCs) in shadow mode or within safety envelopes so that their outputs can be monitored as 'safe probes' without affecting safety. These probes can then be used to build a statistical argument about field performance in a Bayesian way. However, many Bayesian field-data approaches in safety engineering model failures as a simple Bernoulli (or binomial) process with a single global failure probability and i.i.d. trials, which is rarely adequate for MLCs whose performance depends strongly on context. Statistical evidence is also about coverage of relevant situations, including edge cases, and building a single integrated statistical model for the entire system is usually not feasible. To address these challenges, this paper introduces CUBICS, a context-modular framework for per-component, situation-aware performance estimation of safety-relevant ML components. CUBICS partitions the operational design domain into situations and, for each safety-relevant component, defines a set of situation-specific assumptions and probabilistic guarantees that are represented and updated in a Bayesian manner using Subjective Logic (SL). By combining these guarantees with beliefs about how often each situation occurs, CUBICS derives an overall risk estimate for each component without requiring a monolithic system-level statistical model, and thus provides a building block for modular, field-data based safety assurance.
CommentsTo be published in the proceedings for the 37th International Symposium on Software Reliability Engineering (ISSRE 2026)
