Towards algorithm auditing: managing legal, ethical and technological risks of AI, ML and associated algorithms

Abstract

-Business reliance on algorithms is becoming ubiquitous, and companies are increasingly concerned about their algorithms causing major financial or reputational damage. High-profile cases include Google's AI algorithm for photo classification mistakenly labelling a black couple as gorillas in 2015 (Gebru 2020 In The Oxford handbook of ethics of AI, pp. 251-269), Microsoft's AI chatbot Tay that spread racist, sexist and antisemitic speech on Twitter (now X) (Wolf et al. 2017 ACM Sigcas Comput. Soc. 47, 54-64 (doi:10.1145/3144592.3144598)), and Amazon's AI recruiting tool being scrapped after showing bias against women. In response, governments are legislating and imposing bans, regulators fining companies and the judiciary discussing potentially making algorithms artificial 'persons' in law. As with financial audits, governments, business and society will require algorithm audits; formal assurance that algorithms are legal, ethical and safe. A new industry is envisaged: Auditing and Assurance of Algorithms (cf. data privacy), with the remit to professionalize and industrialize AI, ML and associated algorithms. The stakeholders range from those working on policy/regulation to industry practitioners and developers. We also anticipate the nature and scope of the auditing levels and framework presented will inform those interested in systems of governance and compliance with regulation/standards. Our goal in this article is to survey the key areas necessary to perform auditing and assurance and instigate the debate in this novel area of research and practice.

Keywords: artificial intelligence; auditing; bias; explainability; machine learning; transparency.

Figure 1.

Dimensions and examples of activities that are part of algorithm auditing.

Figure 2.

Main learning paradigms of machine learning.

Figure 3.

Traditional ML versus transfer learning versus meta-learning.

Figure 4.

Types and levels of algorithm explainability.

Figure 5.

UK’s Information Commissioner’s Office has a colour-coded ‘Assurance Rating’ for data. Available at: https://ico.org.uk/for-organisations/audits/.

Figure 6.

The overlaps between algorithm robustness, fairness, explainability and privacy.

Figure 7.

Algorithm selection trade-offs: model-specific interpretability versus accuracy.

Figure 8.

Algorithm selection trade-offs: bias (statistical parity) versus performance (accuracy).

Figure 9.

Algorithm selection trade-offs: explainability (feature importance) versus privacy (data minimization).

Figure 10.

(a) Feature importance chart with the breakdown per male and female groups. (b) Explainability (feature importance) based on a bias (disparate impact) metric.

Figure 11.

Interaction between all verticals. The values displayed were estimated by permutation importance using accuracy and average odds difference as loss metrics.

Figure 12.

Information concealed versus feedback detail trade-off curve.

Figure 13.

Feedback loop: from model development, assessment and mitigation, to redevelopment, reassessment and re-mitigation.

Figure 14.

Diagram outlining the steps towards assurance: combining governance and impact assessments with audit and technical assessment; finding equivalent standards and regulations in the sector/end-application; generating a document/audit trail that will feed into certification and insurance as part of assurance.