“Towards Integrated Understanding of Trustworthy AI” – ELSA General Assembly 2026 Workshop 2

Advances in foundation models and multi-agent systems have accelerated the use of AI to test AI. While this offers a unique opportunity to scale AI testing in industry, it also increases the risk of relying on inaccurate and misleading results. This session explores this trade-off, providing practical examples and mitigation strategies.

Text-to-image models such as Stable Diffusion enable the creation of AI-generated child sexual abuse material (AIG-CSAM) on an unprecedented scale. In the context of disabling unwanted capabilities, training data filtering has been called the “gold standard” approach. In particular, to prevent AIG-CSAM generation, several organizations recommend that model developers filter images of children from training datasets. In this talk, I will describe results of our evaluation of the effectiveness of child filtering to disable AIG-CSAM. First, I will describe how we can capture the difficulty of preventing AIG-CSAM generation using a game-based security definition. Second, I will show that current detection methods cannot remove all children from a dataset. Third, using an ethical proxy for CSAM, I will present results of our evaluation of the difficulty to generate the proxy using a range of adversaries.  Our results show that current child filtering methods offer limited protection to closed-weight models and no protection to open-weight models, while reducing the generality of the model. I will conclude by outlining challenges in conducting evaluations that establish robust evidence on the impact of training data filtering defenses for CSAM.

The differential privacy literature consistently reports that, for any fixed privacy budget, the central model always provides superior utility than the local model. In this work, we challenge this prevailing view in the setting of  federated distribution estimation, where multiple independent parties, each holding their own dataset protected with differential privacy (possibly with different parameters $\epsilon_j$), aim to jointly obtain a more accurate estimate of the underlying data distribution without exposing their raw data to one another. 

We compare the standard federated central DP approach with a protocol consisting of two components:  a local DP mechanism ($k$-RR) applied to each data point of each party, and the Generalized Iterative Bayesian Update (GIBU) estimator applied by the aggregator to infer the global distribution. We provide a rigorous theoretical analysis of the Mean Squared Error (MSE) for both approaches. 

Our findings reveal a striking result: when the number of datasets is large, and the data from different parties can be shuffled together, the local DP approach can significantly outperform central DP in terms of the privacy-utility trade-off. The reason is that the estimation error in the central model is approximately proportional to the sum of the variances of the noise added by each server, which relates to the sum of the inverse of the squared privacy parameters, $\sum_j (1/\epsilon_j^2)$. In contrast, in our local DP approach using GIBU, the error is approximately proportional to the inverse of the sum of the squared privacy parameters, $1/(\sum_j \epsilon_j^2)$. 

Consequently, the central model is crippled by the parties with very small $\epsilon_j$, while the GIBU-based local model leverages the aggregate privacy of the entire federation. Extensive experimental evaluations confirm our theoretical results, showing that local differential privacy “strikes back” in federated settings, providing a more robust and accurate estimation than traditional central mechanisms.

The success of deep learning fuelled by the Large Language Models (LLMs), Transformers such as ViT and Foundation Models combined with the abundance of digital data led to the temptation to short-cut from Data to Predictions bypassing the deeper insight, reasoning, semantics, causality and logic which are traditionally related to the model structure or architecture. Deep Learning the way we know it offers unparallel accuracy and generalisation, and class separability, but this comes at the cost of opaque and amorphous internal structure offering little to the increasing demands for human agency and oversight and interpretability in regards to the way the decisions are being made.

In this talk, deep learning pipeline will be re-examined and compared to the traditional machine learning pipeline on one hand and to Cognitive Sciences and Agentic AI pipeline on the other, some parallels with the Brain and the way humans make decisions will also be sketched. This analysis identifies Decision Making as the Achilles heel of the contemporary solutions while the Feature Extraction and hyperparametric optimisation are the backbone of the efficiency and impressive performance. Based on this, an alternative to the so called “end-to-end” mantra will be discussed offering a modular approach centred at prototype-based knowledge representation (KR). The alternative architectural solutions provide more degrees of freedom in regard to interpretability, human agency and oversight and, interestingly, in regard to adaptivity and continual learning. While traditionally, adaptivity (not only in deep learning) is being addressed by additive updates (only) in this talk this is being critically analysed and considered as one of the reasons for the so called “catastrophic forgetting”. An alternative is considered instead – adaptation of atomic KR in the form of prototypes and clusters. Interpretability of images in considered as compositional with semantically meaningful primitive concepts being automatically derived based on clustering embeddings/tokens and their graph representation in the image space. Such KR are considered more adequate than the trivial assumption of weights representing the knowledge. Furthermore, it can be demonstrated that such atomic KR are practically invariant to the latent space transformations and further adaptation during a continual learning process.

Some examples and applications are used mostly as a proof of the concept