Responsible AI deployment practices: Exercises

This page leans on ideas from 6.4.1-Adversarial-examples, 6.4.8-Fairness-metrics, 6.4.12-Explainability-methods, 6.3.2-MLOps-principles, 5.2.4-A-B-testing, and 6.4.14-AI-governanceframeworks. Prefer the Hinglish version? Yeh page Hinglish mein →.

Symbols You Will Need (built once, used everywhere)

Definition The Vocabulary, in Plain Words

$p$ — the failure rate: the fraction of requests that go wrong. If $1$ in $1000$ requests fails, $p = 0.001$ .
$n$ — the number of samples (requests) we observe in a rollout stage.
$α$ — our acceptable miss chance: the probability we are willing to accept of not seeing even one failure even though the model is faulty. $α = 0.05$ means "I accept a $5%$ chance of being fooled."
$ln$ — the natural logarithm (base $e$ ): it answers " $e$ to what power gives this number?" It turns products into sums, which is exactly why it appears when we multiply many independent probabilities together.
Base convention for entropy and KL: throughout this page, $lo g$ inside $H$ and $D_{K L}$ means $lo g_{2}$ (base-2), so both quantities are measured in bits. This choice is stated once here and used consistently; had we used $ln$ instead, the numbers would rescale by the constant factor $ln 2 \approx 0.693$ but the comparisons would be identical.
$D_{K L} (P ∥ Q) = \sum_{i} P_{i} lo g_{2} \frac{P _{i}}{Q _{i}}$ — KL divergence: a one-number score of how different two distributions are. Zero means identical; larger means "the world I now see ( $Q$ ) no longer looks like the world I trained on ( $P$ )." Edge case: if any bin has $Q_{i} = 0$ while $P_{i} > 0$ , the term $lo g_{2} (P_{i} /0)$ blows up to $+ \infty$ , so $D_{K L}$ is undefined (infinite). In practice we apply Laplace smoothing — add a tiny $ϵ$ (e.g. $1 0^{- 6}$ ) to every bin of $Q$ and renormalize — so no bin is ever exactly zero.
$H = - \sum_{i} p_{i} lo g_{2} p_{i}$ — entropy (in bits): how spread out a probability guess is. A confident guess (one class near $1$ ) has low $H$ ; a "I have no idea" guess (all classes equal) has high $H$ . Edge case: a term with $p_{i} = 0$ contributes $0$ (the limit $p lo g p \to 0$ as $p \to 0$ ), so empty classes are simply skipped.

Keep these definitions in view. Every problem below is one of these tools answering one clear question.

Level 1 — Recognition

Exercise 1.1

Match each safeguard to the failure it prevents: (a) Shadow mode, (b) Circuit breaker, (c) Staged rollout, (d) Confidence-based routing. Failures: (i) a rare edge case wiping out all users at once, (ii) users seeing a broken new model at all, (iii) a burst of adversarial inputs cascading into thousands of bad decisions, (iv) a low-confidence prediction acted on with no human check.

Recall Solution

(a) Shadow mode → (ii). The new model runs in parallel but its output is never shown to users, so a failure has zero user impact.
(b) Circuit breaker → (iii). It "trips" after a burst of low-confidence/error signals, capping the blast radius (defined above).
(c) Staged rollout → (i). Growing the audience slowly means a rare edge case first hits a small population.
(d) Confidence-based routing → (iv). Below-threshold predictions are handed to a human. Why this matters: these are the three pillars — pre-deployment (c, a), runtime (b), oversight (d) — each catching a different failure mode. The figure below places each safeguard on the deployment timeline so you can see where each shrinks the blast radius.

Figure — Responsible AI deployment practices

The diagram reads left to right along the deployment lifecycle. Staged rollout (lavender) and shadow mode (mint) act before users are exposed; the widening funnel shows the audience growing only after each gate passes. The circuit breaker (coral) sits at runtime, clamping a spike of failures. Confidence routing (butter) peels off uncertain cases to a human. The shaded "blast radius" band shrinks each time a safeguard intervenes.

Exercise 1.2

In the formula $n \geq \frac{ln ( α )}{ln ( 1 - p )}$ , which symbol is the "acceptable chance of missing a real failure"? Which is the "failure rate"?

Recall Solution

$α$ = acceptable miss chance (e.g. $0.05$ ).
$p$ = the failure rate we hope to catch (e.g. $0.001$ ). $n$ (samples needed) rises when $p$ shrinks (rarer bugs need more looks) and when $α$ shrinks (more certainty needs more looks).

Level 2 — Application

Exercise 2.1

You suspect a failure rate of $p = 0.002$ ( $0.2%$ ). You want a $90%$ chance of catching it ( $α = 0.10$ ). How many samples $n$ must the stage observe?

Recall Solution

WHAT: plug into $n \geq \frac{ln α}{ln ( 1 - p )}$ . WHY this formula: the chance of zero failures in $n$ independent tries is $(1 - p)^{n}$ ; we force that to be at most $α$ , then solve for $n$ . $n \geq \frac{l n ( 0.10 )}{l n ( 1 - 0.002 )} = \frac{- 2.3026}{- 0.0020020} \approx 1150.2$ Round up (you cannot observe a fractional request): $n = 1151$ samples. If daily volume at this stage is $500$ users, that is $⌈ 1151/500 ⌉ = 3$ days.

Exercise 2.2

An image classifier over $3$ classes outputs probabilities $p = (0.7, 0.2, 0.1)$ on a request. Compute the prediction entropy $H = - \sum_{i} p_{i} lo g_{2} p_{i}$ (base-2, so the answer is in "bits" — matching the convention fixed in the Symbols box).

Recall Solution

WHY entropy here: we want a single number for "how unsure is this guess?" A confident guess should score low. $H = - (0.7 lo g_{2} 0.7 + 0.2 lo g_{2} 0.2 + 0.1 lo g_{2} 0.1)$ $= - (0.7 (- 0.5146) + 0.2 (- 2.3219) + 0.1 (- 3.3219))$ $= 0.3602 + 0.4644 + 0.3322 = 1.1568 bits$ Read the figure below to place this number on a scale: the mint bar is a totally sure guess $(1, 0, 0)$ with $H = 0$ ; the coral bar is total confusion $(\frac{1}{3}, \frac{1}{3}, \frac{1}{3})$ with $H = lo g_{2} 3 \approx 1.585$ bits; our butter bar at $1.157$ sits between them — moderately confident. The visual makes concrete why a rising average entropy in production (Exercise 3.2) is an alarm: the bars are sliding rightward toward confusion.

Exercise 2.3

Training feature histogram over $3$ bins: $P = (0.5, 0.3, 0.2)$ . This week's production histogram: $Q = (0.2, 0.3, 0.5)$ . Compute $D_{K L} (P ∥ Q) = \sum_{i} P_{i} lo g_{2} \frac{P _{i}}{Q _{i}}$ (base-2, bits — same convention).

Recall Solution

WHY KL here: it scores "how surprised is a model tuned on $P$ when it meets $Q$ ." Bigger = more drift. $D_{K L} = 0.5 lo g_{2} \frac{0.5}{0.2} + 0.3 lo g_{2} \frac{0.3}{0.3} + 0.2 lo g_{2} \frac{0.2}{0.5}$ $= 0.5 (1.3219) + 0.3 (0) + 0.2 (- 1.3219)$ $= 0.6610 + 0 - 0.2644 = 0.3966 bits$ Note the middle bin contributes zero (it did not move) and the shrinking bin contributes a negative term — but the growing bin outweighs it, so the total is positive, as KL always is. Edge-case reminder: here every $Q_{i} > 0$ , so the sum is well-defined. Had a production bin been empty ( $Q_{i} = 0$ ) while training saw it ( $P_{i} > 0$ ), that term would be $lo g_{2} (P_{i} /0) = + \infty$ and $D_{K L}$ would be undefined — which is why real monitors Laplace-smooth $Q$ first (see Symbols box).

Level 3 — Analysis

Exercise 3.1

A content-moderation model in shadow mode over one week:

Old model false-positive rate: $2.0%$ .
New model false-positive rate: $1.5%$ .
But new-model false positives split: $8%$ on non-English names, $2%$ on English names.

Should you promote the new model to $1%$ traffic? Justify using a fairness lens.

Recall Solution

No. The aggregate metric ( $1.5% < 2.0%$ ) hides a disparity. Using the demographic-parity idea: the false-positive rate differs by group. The ratio $8%/2% = 4 \times$ — a $4$ -to- $1$ gap far beyond a "within $5%$ " parity gate. Diagnosis: English-biased training data taught the model "uncommon character sequences $\Rightarrow$ spam," so names like Xiang or Aditya trip false positives. A lower average error was bought at the expense of a subgroup. Action: do not promote. Return to training with multilingual name dictionaries as protected features; re-run the shadow comparison sliced by group before any staged rollout.

Exercise 3.2

An image classifier's average entropy readings: Train $0.30$ , Week 1 $0.32$ , Week 4 $0.55$ (bits). Interpret the trend and name the likely cause. What specific runtime metric would confirm it?

Recall Solution

Rising entropy = the model is getting less sure on average = it is meeting inputs it was not trained on (out-of-distribution). Week 1's tiny rise ( $+ 0.02$ ) is noise; Week 4's jump to $0.55$ (nearly doubled) is a red flag 🚨. Likely cause: a distribution shift — e.g. seasonal change (bare winter trees in training vs. blossoming spring trees now). This is data drift. Confirming metric: compute $D_{K L} (P_{train} ∥ P_{prod})$ on the input features. If it also spikes past its threshold, drift is confirmed and a retrain is justified. Entropy tells you the model is unsure; KL tells you the inputs actually changed — you want both to agree before acting.

Level 4 — Synthesis

Exercise 4.1

Design a circuit breaker for a spam classifier. Requirements:

Treat a prediction as an "error" if its confidence $< 0.7$ .
Trip (open) when the error rate over the last $w in d o w = 100$ predictions exceeds $t h r es h o l d = 0.10$ .
Under attack, $15%$ of a stream of $1000$ adversarial emails have confidence $< 0.7$ .

(a) After how many emails does the breaker trip? (b) How many bad emails reach users before the trip, and how many are saved by routing the rest to humans? (c) Specify the full state machine — including startup, reset, and cooldown.

Recall Solution

(a) When does it trip? — explicit answer. The breaker compares the error rate over the last $100$ predictions against $t h r es h o l d = 0.10$ , i.e. it trips once more than $10$ of the trailing $100$ are errors ( $11$ or more). With a steady $15%$ error rate the errors arrive at a rate of $0.15$ per email. To accumulate $11$ errors we expect to need $11/0.15 \approx 73.3$ emails — but the window must contain $100$ predictions before a "last-100" rate is even defined, and by the time the $100$ th email is processed the window holds $\approx 0.15 \times 100 = 15$ errors, which is already $> 10$ . So under the steady-rate assumption the very first moment a full trailing window exists ( $n = 100$ ) it already shows $\approx 15$ errors and trips. Explicit answer: the breaker trips at the $100$ th email (the earliest point at which a full $100$ -prediction window exists, at which point it is already over threshold).

(b) Blast radius — explicit numbers.

Emails the model actually processed before tripping: $100$ .
Of those, misclassified (low-confidence errors served): $15% \times 100 =$ $15$ bad emails reached users.
Emails routed to human reviewers after the trip: $1000 - 100 =$ $900$ emails (all remaining traffic goes to fallback).
Bad emails prevented among those $900$ : $15% \times 900 \approx$ $135$ likely errors avoided. Contrast: with no breaker, all $1000$ emails hit the model and $\approx 150$ are misclassified. The breaker cuts served errors from $\approx 150$ down to $15$ — a $10 \times$ reduction in blast radius.

(c) The full state machine — startup, cooldown, and an explicit RESET. The diagram below shows every state and transition; each is spelled out here.

CLOSED (normal): the model serves predictions; each is logged into a sliding window of the last $100$ events.
Startup rule (from the problem statement, no invented hyperparameter): the trip condition is "error rate over the last $100$ predictions exceeds $0.10$ ." Taken literally, that rate is only defined once $100$ predictions exist. Therefore the breaker cannot trip before the window is full ( $n \geq 100$ ) — the startup behaviour is simply "stay CLOSED until the trailing- $100$ window exists." This falls directly out of the given requirement; we add nothing.
OPEN (tripped): all traffic goes to the fallback (human reviewers / safe default); no model calls are made. A cooldown timer runs (a fixed wait, e.g. $60$ s or $N$ events) during which the breaker refuses to touch the model at all — this prevents rapid on/off flapping.
HALF-OPEN (probing, entered automatically when cooldown elapses): the breaker lets a small trial batch through the model. If the trial batch's error rate is back below $t h r es h o l d$ , it transitions to CLOSED; if still high, it returns to OPEN and restarts cooldown.
RESET (explicit transition, HALF-OPEN → CLOSED): "reset" is precisely the successful HALF-OPEN probe — the breaker clears its error window and returns to normal CLOSED operation. There is also a manual RESET: an on-call engineer, after fixing root cause, can force OPEN → CLOSED directly (clearing the window), overriding the automatic path. Both are labelled in the diagram. Design note: the sliding window reacts to recent degradation; the startup rule prevents early flapping; cooldown prevents oscillation; the HALF-OPEN probe (auto-reset) plus the manual reset both restore service; and the fallback guarantees users still get some answer. This is the adversarial-robustness safety net in action.

The full state machine (CLOSED → OPEN → HALF-OPEN, plus both reset paths) that the solution specifies:

Exercise 4.2

Design a monitoring dashboard for a hospital diagnosis assistant. For five panels, state the failure mode each catches and a concrete alert trigger. Tie the design back to the three pillars and governance.

Recall Solution

The wireframe below sketches the five panels as an annotated dashboard; the accompanying reasoning is stated per panel underneath.

Panel 1 — Human override rate. Catches: model no longer useful (doctors reject it). Trigger: $> 15%$ for $6$ h → page on-call. Panel 2 — Feature drift ( $D_{K L}$ ). Catches: inputs no longer match the training world. Trigger: $D_{K L} > 0.5$ → queue retrain. Panel 3 — Average confidence / entropy. Catches: model growing uncertain (out-of-distribution). Trigger: entropy up $> 50%$ over baseline. Panel 4 — Latency P95. Catches: usability degradation and infra stress. Trigger: P95 $> 2$ s → auto-scale. Panel 5 — Demographic breakdown. Catches: emerging subgroup bias. Trigger: parity gap $> 5%$ → block + audit.

Why this maps to the pillars: override rate and demographic breakdown are human-oversight + fairness signals; drift, entropy, latency are runtime monitoring; and every threshold above is a documented, auditable gate — exactly what a governance framework and MLOps discipline demand (each metric traceable, each alert owned).

Level 5 — Mastery

Exercise 5.1

Your rollout budget allows observing at most $n = 5000$ samples in a stage, and you demand $α = 0.05$ confidence of catching a failure. What is the smallest failure rate $p$ you can reliably detect within this budget? Interpret: what does this say about failures rarer than that?

Recall Solution

WHAT: invert the rollout formula for $p$ given $n$ and $α$ . Starting from $(1 - p)^{n} \leq α$ : $n ln (1 - p) \leq ln α \Rightarrow ln (1 - p) \leq \frac{l n α}{n} \Rightarrow 1 - p \leq e^{l n α / n}$ $p \geq 1 - e^{l n (α) / n} = 1 - e^{l n (0.05) /5000} = 1 - e^{- 0.00059915}$ $p \geq 1 - 0.99940103 \approx 0.000599 = 0.0599%$ Interpretation: with $5000$ samples you can catch failures down to roughly $0.06%$ . Anything rarer (e.g. $0.01%$ , one-in-ten-thousand) will slip through this stage undetected with more than a $5%$ chance — this is the long-tail curse: you cannot test your way to safety against ultra-rare events; you need runtime monitoring and circuit breakers to catch them in the wild.

Exercise 5.2

A confidence-based router sends predictions below threshold $τ$ to humans. Suppose raising $τ$ from $0.85$ to $0.90$ increases the human-review load from $12%$ to $22%$ of traffic while cutting automated errors from $3.0%$ to $1.8%$ . Human review costs $\$ 0.50 $/ c a se; e a c ha u t o ma t e d er r or cos t s$ $40 $in d o w n s t r e amha r m . F or$ 100{,}000$ daily requests, which threshold is cheaper? Should cost be the only criterion?

Recall Solution

WHAT: total daily cost $=$ (human-review cost) $+$ (automated-error cost). At $τ = 0.85$ : review $= 0.12 \times 100000 \times \$ 0.50 = $6000 $. E r r or s$ = 0.030 \times 100000 \times $40 = $120000 $. T o t a l$ = $126000 $. * * A t$ \tau=0.90 $: * * r e v i e w$ = 0.22 \times 100000 \times $0.50 = $11000 $. E r r or s$ = 0.018 \times 100000 \times $40 = $72000 $. T o t a l$ = $83000 $. * * C h e a p er : * *$ \tau = 0.90 $, s a v in g$ $43000 $/ d a y . * * S h o u l d cos t b e t h eo n l y cr i t er i o n ? N o . * * I na * m e d i c a l * se tt in g, ana u t o ma t e d er r or i s n o t m er e l y a d o l l a r f i g u r e — i t c anm e an p a t i e n t ha r m, w hi c hi s n o t f u l l y m o n e t i z ab l e . A [[6.4.14 - A I - g o v er nan ce f r am e w or k s ∣ g o v er nan ce p o l i cy]] ma y man d a t e an e v e nhi g h er$ \tau$ (more human review) than the cost-optimal one, and explainability should accompany each routed case so the human reviewer can decide well. Cost sets a floor for the argument, not the ceiling.

Recall Self-Test Cloze

A staged rollout needs $n \geq \frac{l n α}{l n ( 1 - p )}$ samples because the chance of zero failures in $n$ tries is == $(1 - p)^{n}$ ==, forced $\leq α$ . Shadow mode differs from A/B testing because ::: only the old model's output reaches users; the new model is scored silently offline (zero user risk). A rising average entropy signals ::: the model is growing uncertain, likely meeting out-of-distribution inputs (drift). KL divergence is undefined when a production bin is empty because ::: $lo g_{2} (P_{i} /0) = + \infty$ ; we Laplace-smooth $Q$ to fix it. A circuit breaker returns from OPEN to CLOSED via the ::: HALF-OPEN state (auto-reset probe) or a manual reset by the on-call engineer.