This paper contributes to the practical implementation of the third pillar of trustworthy AI: technical and social robustness. We enhance the robustness and reproducibility of an AI model through the integration of polluted data into the AI training process. To do so, the YOLO11n model backbone is fine-tuned with a subset of the PASCAL VOC12 benchmark data using diferent shares and intensities of a horizontal blur polluter in the training data. Through this approach we are able to reach a significant increase in robustness on similarly polluted test data. Hereby, the training of AI systems becomes better aligned with context- and environment-specific conditions. This approach does not only contribute to the technical robustness of AI systems but poses the opportunity to also boost their social robustness, by increasing their adaptability to diverse and dynamic real-world settings.
While both the Ethics Guidelines for Trustworthy AI as well as the ALTAI are more focused on ethics
than engineering, some requirements allow the derivation of technical approaches for ethical problems
[
This paper is concerned with the impact of deteriorating DQ on the robustness of AI perception
models. ISO 5259:2024 [
It is to be diferentiated between data used during AI development and the new and unlabelled
inference data , the model is met with during usage. The larger the gap between these types of data is,
the more the performance of AI models sufers. However, for the development data to be completely
representative of every possible manifestation of inference data is hardly feasible due to the complexity
of real-world events. Besides diferences in distribution between data sets or temporal evolution due to
the non-stationarity of data [
As a method to mitigate this, corruption-based data augmentation is increasingly used as a standard for safety-critical applications by training models with (partially) polluted data. Hereby, the model can achieve increased robustness towards the type(s) of pollution it was trained with.
Social robustness of AI systems can be understood as their robustness to (unpredictable) social changes.
This may include erroneous or unseen data (e.g., incorrect data collection in marginalized groups) [
Technical robustness provides a measure on the resilience of AI models towards sub-optimal
application environments. In this regard, AI robustness "refers to the ability of a system to maintain consistent
performance when exposed to diverse, unexpected or even adversarial inputs" [
Formally, Zhang et al. [
We adapt Zhang et al.’s quantification of robustness [
= ( ) − (( )) = 1 − (( ) − (( )).
As a measure of the correctness of the AI model, we choose the mean Average Precision (mAP),
i.e. the mean value of average precision over all classes. More specifically, the mAP averaged over
intersection over union (IoU) thresholds from 0.50 to 0.95 in steps of 0.05 (mAP50:95) is chosen which
was first introduced within the COCO documentation. It allows for a broad assessment of the model’s
performance balancing recall and precision. [
Therefore, we define robustness as = 1 − ( @0.50 : 0.95 − @0.50 : 0.95 ) (3) with @0.50 : 0.95 displaying the mean average precision on clean inference data and @0.50 : 0.95 on polluted inference data. Since the mAP@0.50:0.95 is limited to values between 0 and 1, 1 signifying the highest possible precision, our measure of robustness signals low robustness to increased DQ issues in inference data when approaching 0 and high robustness if it approaches 1. Once exceeds 1, this signifies a better performance on polluted data compared to optimal conditions with the gap in performance increasing with approaching 2. Depending on the model type and context of application, this equation works with any other performance indicator that can be normalized to values between 0 and 1 with convergence to 1 indicating high performance. We developed this notion of robustness to specifically consider machine learning models and it can be adapted to other metrics of performance which can be normalized to values between 0 and 1, increasing with performance. An in-depth comparison to other notions of robustness will be investigated in future work.
Since we are assessing the performance of each model on a multitude of pollution intensities, robustness towards multiple intensities of pollution will be estimated by the application of an average over the performance of the models on the diferent test intensities. In this case, the correctness of the model with decreased quality of diferent intensities is defined as (1) (2) (4) (5) ∑︀=1 @0.50 : 0.95 with signifying the number of diferent pollution intensities. For completion, the final formalization for average robustness is = 1 − ( @0.50 : 0.95 −
=1 @0.50 : 0.95 ∑︀ ) or = 1 − ( @0.50 : 0.95 −
=1 @0.50 : 0.95) ∑︀
However, it is not possible to draw conclusions from neither nor on the level of performance of the investigated models. Therefore, for a complete assessment, both @0.50 : 0.95 and @0.50 : 0.95 or @0.50 : 0.95 should be taken into account, respectively.
The empirical work conducted in this paper adds to the previously published literature [
(6)
3.1. Data The benchmark data set chosen for analysis is the PASCAL VOC12 data set [22]. It consists of 11,530 images containing 27,450 annotated objects from 20 classes from the categories Person, Animal, Vehicle, and Indoor. PASCAL VOC12 was chosen due to its similarity to COCO which is the foundation for the YOLO object detection models as described in Section 3.2. It is widely used for AI assessment within the literature [23, 24]. The objects within PASCAL VOC12 are marked as dificult, truncated, or occluded, if applicable. For the means of this analysis, the data set was subset to only include images that display ground-based vehicles, i.e. bicycles, busses, cars, motorbikes, and trains. While the data set was subset by the previously stated classes, the class Person was included additionally for training and inference. Furthermore, objects that were marked as dificult were excluded, while objects marked as truncated and occluded remain in the data set.
The final data set consists of 2,055 images, including 7,504 objects from six classes. 1 A direct comparison between the original and subset data set is displayed in Table 1 and class distribution is displayed in Table 2. The images in the data set were resized such that the longest image side measures 416 pixels to obtain comparable pollution intensities across all images. 1Our code including the creation of the data set and all experiments will be made available online pending institute permission. To get access to the repository, please contact the authors. 3.2. Model We chose Ultralytics YOLO11 [25] as a state-of-the-art framework which is highly utilized for real-time object detection across various domains [26, 27]. YOLO is widely used in the literature in research on object detection and transfer learning [23, 28, 29]. Specifically, we are using YOLO11n as a pre-trained model to fine-tune with our data set. YOLO11n is trained with the COCO data [ 30] set consisting of 80 classes, including ground-based vehicles and persons, rendering it fitting for the observed fictitious use-case.
As a polluter to test our hypotheses with, we choose a horizontal blur to mimic motion blur pollution, which may occur when data collection includes either moving cameras or moving targets. We apply a square convolutional kernel which averages over the horizontally neighbouring pixels. Following [31], it can be formalized as , [, ] = {︃ 1 0 if − ≤ ≤ and = 0 otherwise with as the kernel width 2 + 1 and for in the range of 1 to 22 in steps of 3, resulting in the kernel width ranging from 3 to 45 pixels in steps of 6. For kernel width , a pixel of input image at position , is convoluted to output pixel ′(, ) as follows
′(, ) = 1 ∑︁ ( + , ).
=−
Following, the blur intensities will be expressed as the percentage of kernel width to maximum image side length of 416 pixels, i.e. as /416%. This leads to a range of intensities of 0.72 to 10.82% in steps of 1.5%. Figure 1 displays an example image with no blur as well as intensities of 0.72, 6.49, and 10.82%. While the image with low the lowest blur intensity is only marginally perturbed, the higher blur intensities display a high level of pollution. (7) (8)
Transfer learning is used to train the model, i.e. the fine-tuning process with the data set described in Section 3.1 is conducted using the back-bone of YOLO11n. For each experiment, the model set up is held constant using the parameters in Table 3. For testing, the best model is chosen for each of the experiments.
A split ratio of 70% (1,439 images) for training and both 15% (308) for validation and test data was applied and implemented using multi-label stratified split to ensure similar distribution across all data sets. Each experiment including the splitting process was repeated over 10 seeds to mitigate the possibility of randomly occurring bias in the distribution. Training & validation pollution shares 0%, 10% 20%, 40%, 60%, 80%, 100% Test pollution shares 0%, 100% Training & validation pollution intensities 0.72%, 2.16%, 3.61%, 5.05%, 6.49% Test pollution intensities 0.72%, 2.16%, 3.61%, 5.05%, 6.49%, 7.93%, 9.36%, 10.82% Seeds 1, 2, 3, 4, 5, 6, 7, 8, 9, 10
Within one seed, the model was trained using the same training and validation splits which were varied in (1) the share of polluted data, and (2) the intensity of pollution. For each split, a baseline model was trained on clean training and validation data. Table 4 displays the full list of experimental parameters and values. The additional models were trained using shares between 10 and 100% of polluted training and validation data and blur intensities between 0.72 and 6.49%. Each model was then tested on a clean test set as well as test sets fully polluted with blur intensities of 7.93, 9.36, and 10.82% additionally to those used for training.
To validate the experiments conducted in this paper, we are currently working on additional experiments investigating further pollution types. While first results on experiments on Gaussian noise appear to corroborate the results reported in the following section, the current status of the experiments is not advanced enough to report on them.
Figure 2 displays the performance of the diferent models on increasingly polluted test data for each share of training pollution. The grey line corresponding to a training blur of 0% is trained on clean data. It therefore acts as the baseline model and does not vary across the diferent shares (a) to (f). For clean test data, the baseline model reaches a mAP of 0.92, indicating a good model performance under unperturbed conditions. However, its decreases rapidly with increasing test pollution. While its mAP comes within 0.5 for the first time at a blur intensity of 3.6%, it falls to 0.042 at the maximum pollution of 10.8%. The models with the smallest intensity of blur in the data mirrors the decline of the clean model, however the performance is slightly better for polluted test blur, with the performance on polluted test blur increasing with the share of polluted training data. Models with training intensities of 2.2 to 6.5% show more pronounced diferences compared to baseline, even at a low share of polluted training data of 10%. In Figures 2 (a) to (e), the decrease in performance is much lower with increasing test blur intensities than it is for baseline, with both higher shares and intensities of polluted training data reducing the overall decrease in performance. While higher shares and intensities of polluted training data decrease the performance on clean data slightly, the advantage polluted models have on polluted test data is distinctly higher. For the model with 80% of training data polluted at the highest level of 6.5%, the decrease in mAP amounts to 0.048 compared to baseline on clean data, while it is by 0.648 higher than baseline at a test blur intensity of 10.8%. An interesting observation to be made is that even though each model displayed in Figures 2 (a) to (e) is only familiar with clean data and data polluted with the respective training intensity, the performance of the model also improves significantly on test data of pollution intensities which are unfamiliar to the model. All models perform as well or better on test data which is polluted in a lesser intensity than the model is trained with. This changes for Figure 2 (f) which displays the performance of models trained on fully polluted data. These models were not made familiar with clean data during the fine-tuning process and generalize poorly to clean test data while they also do not perform as well towards data with a lesser pollution intensity, resulting in them peaking in performance on the pollution level their training data was polluted with. This underscores an observation which holds true for all graphs in this figure: For each test intensity, the model trained with the same pollution intensity reaches the highest performance within one training share. This efect increases in pronunciation with increasing training share.
To allow for the integration of these levels of performance into the concept of robustness as previously defined in Section 2.2, Figure 3 displays the average robustness and their components. Figure 3 (a) shows the components of Equation (3) for each of the models. At a share of 0%, the models were trained on clean data showing the performance of the baseline model. The mAP on clean data ( @0.50 : 0.95) indicates the performance of the trained models on clean test data. The models trained with the lowest blur intensity of 0.7% remain almost constant in performance over the diferent shares of polluted training data. It even increases performance slightly when introduced at lower levels. For higher train blur intensities, increasing shares in polluted training data lead to a monotonous decline in performance up to a share of 80%. The decline increases with the severity of pollution intensity and ranges from a minimal decline of 0.003 for a training blur pollution of 0.7% to 0.048 for 6.5% compared to the baseline performance of 0.92. The decrease is rather small, suggesting that generalization to clean data can still be obtained to a large degree. However, at 100% polluted training data, average precision decreases significantly for pollution exceeding the intensity of 0.7%. While the lightest pollution intensity experiences only a small decline of 0.019, the higher training intensities increasingly plummet with the 6.5% intensity dropping the maximum amount of 0.813. The average mAP over polluted data ( @0.50 : 0.95 ) show an average of the model performance on the diferent test pollution intensities as expressed in Equation (4). For intensities above 0.7%, the highest increase in average performance can be observed between clean training data and the lowest share of polluted training data of 10%. From there on, average performance keeps on increasing moderately up to a training share of 80%. For shares up to 80% of polluted training data, all models perform better on clean data compared to the models’ average performance on polluted data. However, at 100% polluted test data, performance on clean test data drops below that on polluted data for all intensities but 0.7%.
Figure 3 (b) displays the full measures of robustness as defined in Equations (5) and 6. It is apparent that the average robustness increases both with intensity of training blur and share of polluted training data, while the measures for average robustness converge with higher intensities. This increase is, again, least pronounced for the lowest training blur intensity. At fully polluted training data, all models from training intensity 2.2% and up exceed the mark of 1, indicating that the performance of these models are worse on clean than on polluted data. We can observe the least robust model to be the baseline model with an average robustness of 0.405. This indicates a gap between performance on clean data and average performance on polluted data of 0.595. The highest level of average robustness without reversing can be observed at training with a share of 80% of polluted training data at the highest intensity of 6.5%. Here, the average robustness amounts to 0.939, indicating a gap between performance on clean and polluted data of 0.061. However, this does not only come from the increase in performance on polluted data, but also on a decrease on clean data of 0.042 compared to baseline.
This paper’s results indicate a significant increase in robustness towards DQ deterioration in inference data when models are trained with data that was perturbed with the corresponding pollution, in this case horizontal blur. This adds to previous findings indicating that data which the model is made familiar with during training is more easily identified during testing, even if the data undergoes a loss of information. Our findings indicate that robustness increases with the share and intensity of polluted training data. However, the trade-of between decrease of performance on clean data and increase on polluted data increases with the same parameters. Therefore, it appears to be advised to balance both the share and intensity of polluted training data based on observed or expected pollution in real-world inference data to prevent a potentially unnecessary decrease in model performance on clean data. Thus, the added value is highly dependent on the specific use case.
An in-depth evaluation of both development and inference data is further advised to truly increase trustworthiness through robustness from both a technical and social perspective. To do so, potential quality issues within data must be identified dependent on the use case to subsequently introduce relevant data corruptions in the training data.
This paper examined the interrelation between data quality, robustness, and the trustworthiness of
AI systems. We demonstrated that the robustness of an AI system can be enhanced by integrating
deliberately perturbed data into the training process. Hereby, the training of AI systems becomes better
aligned with context- and environment-specific conditions. This approach does not only contribute to
the technical robustness of AI systems but poses the opportunity to also boost their social robustness,
by increasing their adaptability to diverse and dynamic real-world settings. Incorporating new or
previously underrepresented features into data sets ofers the opportunity to better capture complex
social nuances, contributing to more context-aware and socially responsive AI systems. Enhancing
both technical and social robustness is closely linked to the third pillar of Trustworthy AI [
There are some limitations to this work at this point in time which we want to address. First of all, the results discussed correspond to the YOLO11n object detection model and need to be contextualised with further research on additional model specifications. Furthermore, the perturbation type is limited both in scope and transferability to real world blur. Future work may therefore focus on the identification and as close as possible imitation of perturbations observed in real-world data and be tested on data that displays real-world blur for validation purposes. Investigating whether this approach also facilitates increased robustness to diferent types of pollution within one model is promising.
Also, the applicability of this approach highly depends on the context within which the AI model is used. Choosing suitable pollution types as well as intensities requires use-case specific investigation of the sensors, expected environments and comparable data. Future research should interest itself with the formalization of this process, whereas we expect a combination of both ex-ante and iterative approaches to yield most promising results. Therefore, an in-depth focus on the use-case specific application is essential.
Finally, while we see this paper as a contribution to the third pillar of trustworthy AI, DQ is always connected to ethical (e.g., data acquisition, completeness) and legal (e.g., data protection, AI Act) aspects. Especially, if we want to have technical and social robustness as trust-enablers, it might be necessary to add additional safeguards like (trained) human operators. Further exploration of this relation is essential to deepen our understanding and move closer to realizing the vision of trustworthy AI.
During the preparation of this work, the authors used GPT-4o in order to: Generate Literature Review and Aid Programming. After using this tool/service, the authors reviewed and edited the content as needed and take full responsibility for the publication’s content. [22] M. Everingham, L. Van Gool, C. K. I. Williams, J. Winn, A. Zisserman, The PASCAL Visual Object Classes Challenge 2012 (VOC2012) Results, http://host.robots.ox.ac.uk/pascal/VOC/voc2012/index.html, 2012. [23] N. Zhao, Enhancing object detection with yolov8 transfer learning: A voc2012 dataset study, in: Proceedings of the 1st International Conference on Engineering Management, Information Technology and Intelligence, SCITEPRESS - Science and Technology Publications, 2024, pp. 429– 434. doi:10.5220/0012939600004508. [24] Q. Zhou, C. Yu, Z. Wang, Q. Qian, H. Li, Instant-teaching: An end-to-end semi-supervised object detection framework, 2021. doi:10.48550/arXiv.2103.11402. [25] G. Jocher, J. Qiu, Ultralytics YOLO11 (Version 11.0.0, License AGPL-3.0) [software], 2024. URL: https://github.com/ultralytics/ultralytics. [26] L. HRIC, J. A. BACIK, D. PERDUKOVA, Real-time object detection of simple drawings using yolo11 on constrained datasets, MM Science Journal 2025 (2025). doi:10.17973/mmsj.2025_ 03_2024118. [27] M. Mao, M. Hong, Yolo object detection for real-time fabric defect inspection in the textile industry:
A review of yolov1 to yolov11, Sensors (Basel, Switzerland) 25 (2025). doi:10.3390/s25072270. [28] L.-H. He, Y.-Z. Zhou, L. Liu, W. Cao, J.-H. Ma, Research on object detection and recognition in remote sensing images based on yolov11, Scientific reports 15 (2025) 14032. doi: 10.1038/ s41598-025-96314-x. [29] M. A. R. Alif, Yolov11 for vehicle detection: Advancements, performance, and applications in intelligent transportation systems, 2024. doi:10.48550/arXiv.2410.22898. [30] T. Lin, M. Maire, S. J. Belongie, L. D. Bourdev, R. B. Girshick, J. Hays, P. Perona, D. Ramanan, P. Dollár, C. L. Zitnick, Microsoft COCO: common objects in context, CoRR abs/1405.0312 (2014).
URL: http://arxiv.org/abs/1405.0312. arXiv:1405.0312. [31] A. Torralba, P. Isola, W. T. Freeman, Foundations of Computer Vision, Adaptive Computation and Machine Learning series, MIT Press, 2024. URL: https://mitpress.mit.edu/9780262048972/ foundations-of-computer-vision/.