In software engineering, the integration of machine learning (ML) and artificial intelligence (AI) components into modern web services has become commonplace. To comply with evolving regulations, such as the EU AI Act, the development of AI models must adhere to the principles of transparency. This includes the training data used, the intended use, potential biases, and the risks associated with these models. To support these goals, documents named Model Cards were introduced to standardize ethical reporting and allow stakeholders to evaluate models based on various goals. In our ongoing research, we aim to automate risk analysis and regulatory compliance checks in software systems. We envision that model cards can serve as useful tools to achieve the goal. Given the evolving format of model cards over time, we conducted a state-of-the-art review of the current state and practice of model cards by analyzing 90 model cards from four model repositories to assess their relevance to our vision. The study's contribution is a thorough analysis of the model cards' structure and content, as well as their ethical reporting. Our study reveals the variance in information reporting, the loose structure, and the lack of ethical reporting in the model cards. Based on the findings, we propose a unified model card template that aims to enhance the structure, promote greater transparency, and establish a foundation for future machine-interpretable AI model cards.

There is an increasing need for practitioners to address legislative and ethical issues in both the development and deployment of data-driven applications with AI/ML due to growing concerns and regulations, such as GDPR and the EU AI Act. Thus, the field needs a systematic framework for assessing risks and helping to stay compliant with regulations in designing and deploying software systems. Clear and concise descriptions of risks associated with each model and data source are needed to guide the design without acquiring deep knowledge of the regulations. In this paper, we propose a reference architecture for an ethical orchestration system that manages distributed AI/ML applications on the cloud–edge continuum and present a proof-of-concept implementation of the main ideas of the architecture. Our starting point is the methods already in use in the industry, such as model cards, and we extend the idea of model cards to data source cards and software component cards, which provide practitioners and the automated system with relevant information in actionable form. With the metadata card based orchestration system and information about the risk levels of the target infrastructure, the users can create deployments of distributed AI/ML systems that fulfill the regulatory and other requirements.

Recently emerging software-defined networking allows for centralized control of the network behavior enabling quick reactions to security threats, granular traffic filtering, and dynamic security policies deployment making it the most promising solution for today’s networking security challenges. Software-defined networking coupled with network function virtualization extends conventional security mechanisms such as authentication and authorization, traffic filtering and firewalls, encryption protocols and anomaly-based detection with traffic isolation, centralized visibility, dynamic flow control, host and routing obfuscation, and security network programmability. Virtualized security network functions may have different effects on security benefit and service quality, thus, their composition has a great impact on performance variance. In this study, we focus on solving the problem of optimal security function chaining with the help of reinforcement machine learning. In particular, we design an intelligent defense system as a reinforcement learning agent which observes the current network state and mitigates the threat by redirecting network traffic flows and reconfiguring virtual security appliances. Furthermore, we test the resulting system prototype against a couple of network attack classes using realistic network traffic datasets.