Special issue on trustworthy and safe AI: Interpretability, robustness, and security

Abstract

Recent advances in artificial intelligence (AI), particularly in large language models (LLMs) and physical robotics, have rapidly reshaped daily life and industrial applications. As these systems become more capable and autonomous, ensuring their safety, trustworthiness, robustness, and alignment with human values has become increasingly important. In response to these challenges, this special issue on “Trustworthy and Safe AI: Interpretability, Robustness, and Security” brings together recent research that advances the safety and trustworthiness of AI across diverse models, systems, and real-world applications.

This special issue received 50 submissions, reflecting the growing research interest in trustworthy and safe AI. Following a rigorous peer-review process, 11 papers were selected for publication. Together, these studies span several interconnected dimensions of the field, ranging from emerging security threats in LLMs and multi-agent systems to robustness, autonomous system safety, and explainability for practical deployment.

The following five papers focus on emerging security and safety threats across modern AI systems. These studies examine how vulnerabilities arise from adversarial attacks, multi-agent interactions, social context, multilingual settings, and hidden information while exploring the corresponding mechanisms for detection and defense.

In [1], the authors investigate a more evasive mixed clean/dirty-label X-to-X backdoor attack and propose an ensemble defense that combines complementary detectors such as Neural Cleanse, PT-RED, CEPA, and MMBD. This work is significant because it addresses both robustness and interpretability, and the ensemble improves resilience across diverse backdoor mechanisms while also supporting trigger inversion to help explain the nature of the detected attack. By jointly considering stronger adversarial attacks, generalized defense, and interpretable backdoor analysis, this study aligns well with the themes of Trustworthy and Safe AI: Interpretability, Robustness, and Security.

In [2], the authors study how a single malicious agent can compromise the collective decision-making of otherwise well-aligned LLM agents in a collaborative financial multi-agent environment and proposes a data-lineage-based systemic defense. Its main contribution is to show that the interaction dynamics themselves can become a security vulnerability, extending AI safety concerns beyond isolated models to multi-agent societies. By analyzing poisoning, social conformity, and system-level verification across multiple models and network settings, this study offers timely insights into the robustness, safety, and trustworthy coordination of emerging autonomous multi-agent AI systems.

The paper [3] titled “Lost in the comments: Social context as a single-pass jailbreak and defense on agentic platforms” by Jeongsu Park and colleagues investigates how comments, reactions, and engagement signals surrounding harmful content influence the safety behavior of LLMs in agentic social platforms. The study demonstrates that the ambient social context, even without explicit malicious instructions, can substantially alter attack success rates, whereas ethically framed comments can reinforce safe behavior through the same contextual channel. Through controlled experiments that varied the valence, volume, and engagement of social signals, this study shows that the nature of the surrounding commentary is more important than its quantity in determining whether model safety is weakened or strengthened. This work is particularly valuable because it extends indirect prompt-injection research to the emerging setting of multi-agent platforms and provides evidence that social context can function as both an attack mechanism and a potential defensive control. Supported by comparisons with PAIR, independent rescoring with WildGuard, human adjudication, and signal-separation ablation studies, this study offers a timely and practically meaningful contribution to the secure design and operation of future agentic AI ecosystems.

While past research has primarily focused on how well AI can translate and understand multiple languages, recent studies have increasingly shifted attention toward cross-lingual safety—whether the safety alignment learned from English transfers reliably across languages.

This study [4] shows that the cross-lingual safety of open-weight LLMs is highly language-dependent rather than a generic vulnerability shared across all non-English languages. Through a systematic evaluation of six open-weight LLMs with a particular focus on Korean and Chinese, this study finds that safety erosion varies substantially by language and appears to be closely associated with the extent of language-specific safety alignment coverage.

Notably, this study identifies two distinct vulnerability patterns: one includes models whose safety degradation is strongly affected by translation quality, and the other includes models that remain vulnerable even under high-quality translations. It also reveals a “no man's land” between monolingual safety detectors, where mixed-language inputs can exploit a between-language blind spot. Taken together, these findings reframe multilingual AI safety as a per-language alignment problem and provide practical guidance for improving safety in real-world multilingual deployments.

The paper [5] titled “SF-CAMNet: A spatial–frequency fusion network for rrobust spatial domain image steganalysis” by Batool and Bashir proposes a dual-branch network that detects data hidden in digital images by fusing spatial residuals with frequency-domain features. By combining SRM filters and attention modules in the spatial branch with a wavelet-transform branch, the model uses cross-attention so that frequency cues adaptively reweight spatial features. Evaluations on BOSSBase v1.01 and BOWS2 across five adaptive steganography algorithms show competitive accuracy at a computational cost far below that of recent transformer-based baselines, offering a practical and efficient direction for digital forensics and cybersecurity.

The other two studies address the robustness and reliability of AI models under imperfect input conditions. These studies investigate how conflicting evidence and corrupted inputs can affect model behavior and how reliable performance can be maintained beyond standard evaluation settings.

The paper [6] titled “Diagnosing judgment flip risk in LLM fact verification under conflicting evidence” by Roh and Bae introduces a flip-rate protocol that measures how often a correct verdict of an LLM fact verifier becomes incorrect when the retrieved evidence is perturbed in terms of ratio, quantity, or order. Across six models and two datasets, even a single refuting passage flips a nontrivial share of correct judgments, and the flip rates exceed 60% on FEVER and 90% on SciFact under full conflict. This study shows that clean evidence accuracy alone is an insufficient reliability indicator, establishing evidence composition as a distinct axis of robustness evaluation.

The paper [7] titled “Cross-corruption distillation for robust instruction following under text corruptions” by Bae and Bae proposes cross-corruption distillation, which reframes knowledge distillation from matching a teacher's static outputs to aligning the corruption-induced logit differences between teacher and student through a KL objective. Across English and Korean multimodal benchmarks, CCD preserves competitive clean performance while improving robustness against text corruption. This study broadens the notion of knowledge distillation from transferring what a teacher predicts to transferring how it responds to input perturbations, thereby providing a behavior-level framework for training more robust multimodal models.

The following three papers further explore the integration of trustworthy AI into autonomous and safety-critical systems. These studies address human–AI interaction, reliable system validation, and the safe incorporation of AI-driven decision making in automated driving and autonomous UAV operations.

The paper [8] titled “STPA-based analysis of driver misuse risk scenarios in level 3 automated driving” by Lee and others proposes an analytical framework that integrates the safety of the intended functionality (SOTIF) perspective with system-theoretic process analysis (STPA) to systematically analyze driver misuse in level 3 automated driving, where safety critically depends on the driver's response to take-over requests (TOR). Rather than treating misuse as an isolated behavioral error, this study interprets it as inadequate control within the driver–system interaction structure, deriving 41 causal scenarios with four psychological states—overtrust, distrust, distraction, and interference—as causal factors and evaluating them in terms of severity, likelihood, and controllability. Clustering analysis further identifies recurring risk archetypes, such as perception failure, warning configuration error, and delayed response, showing that many high-risk scenarios stem from the driver's failure to perceive or properly respond to TORs. By providing a structured basis for understanding driver misuse risks, this study offers practical implications for driver monitoring, HMI design, and multilayer safety assistance mechanisms for trustworthy and safe automated driving.

The paper [9] titled “Development of two-phase framework for driver behavior classification and representative motion prototyping for reliable simulation-based driver monitoring system” by Kurniadi and others proposes a two-phase framework that automatically generates realistic driver motion baselines from in-cabin 3D skeleton data, bridging driver behavior recognition and simulation-based validation of driver monitoring systems (DMS). In phase 1, eight driver behaviors are classified using a spatial temporal graph convolutional network (ST-GCN++), validated against representative skeleton-based baselines on a subject-independent dataset, and in phase 2, the real recorded sequence closest to each class-wise mean trajectory is selected using dynamic time warping (DTW), producing a compact and verifiable motion library rather than synthetic averages. The extracted prototypes are retargeted onto MetaHuman characters in Unreal Engine, demonstrating their direct applicability to virtual scenario generation and standardized human-subject experiments. By establishing interpretable, traceable, and verifiable behavioral baselines, this study instantiates the principles of trustworthy AI in driver monitoring and contributes to reliable simulation-based safety testing for automated driving.

The paper [10] titled “LLM-guided semantic-aware trajectory optimization for UAV path planning using environmental context” by Lee and others proposes a semantic-aware trajectory planning framework for urban UAV operations in which a LLM serves as a high-level semantic decision module rather than a direct trajectory generator. A semantic grid map constructed from OpenStreetMap data was transformed into a differentiable semantic potential field, and the LLM adaptively modulates class-wise semantic weights according to the environmental context and mission intent, while a downstream B-spline optimizer generates smooth and collision-free trajectories. Simulation results in urban environments show that the proposed framework effectively increases clearance from semantically sensitive regions, such as schools and hospitals, compared with conventional fixed-cost planners, while keeping trajectory variations bounded under stochastic LLM outputs. By constraining the LLM to a bounded and interpretable semantic-policy interface, this study presents a principled method to combine natural-language mission reasoning with deterministic trajectory optimization, contributing to trustworthy and safe autonomous UAV operations.

The final paper highlights the role of explainability in translating high-performance AI models into trustworthy, real-world applications. It emphasizes not only how AI decisions can be made interpretable but also how their explanations can be validated by domain experts for practical use.

AI-based visual grading has the potential to improve the speed and consistency of agricultural quality assessments; however, high predictive accuracy alone is not sufficient in practice. AI decisions must also be transparent and traceable to established grading criteria, particularly when they directly affect export value and farmers' income.

To address this challenge, a study [11] examines explainability from two complementary perspectives: conventional post-hoc XAI methods that explain a pretrained classifier and a compositional approach that embeds interpretability directly into the grading process through segmentation, attribute classification, and rule-based decision-making. Using 4603 expert-graded clove images, the authors systematically compare explanation quality across multiple deep learning architectures and introduce the explanation energy ratio (EER) as a quantitative measure of how strongly model explanations align with the relevant object regions.

A key finding was that similar classification accuracies could mask substantial differences in explanation quality and robustness. Models that performed nearly identically in-domain can behave differently under background shifts. Importantly, this study goes beyond algorithmic evaluation by validating explanations with certified commodity graders. The compositional approach achieved the highest grade of agreement and was unanimously preferred for regulatory auditing, providing rare real-world evidence that interpretable-by-design systems can better support practical deployment.

Collectively, the studies presented in this special issue highlight the expanding scope of trustworthy and safe AI, from model-level security, robustness, and interpretability to the safety of increasingly autonomous and interconnected AI systems. Together, these underscore the importance of addressing AI safety and trustworthiness not only at the model level but also across system integration and real-world deployment. We hope that the studies presented in this special issue will stimulate further research on safer, more robust, transparent, and trustworthy AI systems. We sincerely thank all the authors, reviewers, and editorial staff of the ETRI Journal for their valuable contributions to this special issue.

The authors declare that there are no conflicts of interest.