Dataset analysis capabilities allow T&E stakeholders to understand held out T&E datasets, including their quality and similarity to operational data. This dimension is focused on assessing properties of a dataset that are independent of a particular AI model under test. Example functionalities include (but are not limited to) the computation of:

• Dataset quality (e.g., label errors, missing data) 
• Dataset sufficiency for a given test (e.g., number of samples, variation) 
• Biases, outliers, and anomalies in the dataset, which may be naturally occurring or intentionally inserted (i.e., data poisoning)
• Comparison of two datasets (e.g., divergence of dataset distributions)

Model performance capabilities allow T&E stakeholders to assess how well an AI model performs on a labeled dataset and across its population subclasses. Example functionalities include (but are not limited to):

• A comprehensive set of well-established CV metrics (e.g., precision, recall, mean average precision) 
• Metrics to assess probability calibration, i.e., the reliability of the model's measure of predictive uncertainty (e.g., expected calibration error, entropy, reliability diagrams)
• Metrics to assess fairness and bias in model output across the test dataset (e.g., statistical parity)

In addition to pre-defined metrics, capabilities will support the creation of custom, user-defined metrics.

Model computational performance capabilities allow T&E stakeholders to measure the computational efficiency, resource usage, and scalability of an AI model. Example functionalities include (but are not limited to) the computation of:

• Model throughput, latency, resource usage, and scalability, as well as constraints on these properties
  
• Model performance across different hardware configurations
• Optimal batch sizes for model inference

Model analysis capabilities expand upon the model performance dimension by allowing T&E stakeholders to gain a deeper understanding of a model's capabilities and limitations by uncovering hidden trends, patterns, or insights across the input space. Example functionalities include (but are not limited to) algorithms that:

• Detect trends in model performance across the entire dataset, such as distinct types of model errors
• Identify clusters of the model input space based on model predictions, feature values, network activations, etc.
• Identify potentially mislabeled ground truth data based on sets of model predictions
• Determine under-tested or high-value regions of the input space (for the model under test) to inform future test data collection or labeling

Natural robustness capabilities enable T&E stakeholders to determine how natural corruptions in data can impact model performance. These corruptions emulate realistic noise that may be encountered within the operational deployment environment. Example corruptions include (but are not limited to):

• Pre-sensor, environmental or physical corruptions (e.g., fog, snow, rain, changes in target shape or dimensions)
• Sensory corruptions (e.g., out-of-focus, glare, blur)
• Post-sensor, in-silico corruptions (e.g., Gaussian noise, digital compression)

Capabilities for creating these corruptions may leverage synthetic data generation techniques. Capabilities will provide users with the ability to control the severity level of the corruption, so that performance can be reported as a function of severity level and T&E stakeholders can use these results to set or assess requirements on performance and robustness.

Adversarial robustness capabilities enable T&E stakeholders to assess how adversarial corruptions on data inputs may impact model performance. The primary focus of this dimension will be on evasion-style attacks (i.e., attacks in which the adversary aims to manipulate the input data to produce an error in the model output, often covertly). Example types of attack methods include (but are not limited to):

• White-box and black-box methods
• Mathematical (e.g., Lp norm-constrained) and physically realizable (e.g., patch) attacks
• Empirical and certified attacks

In addition to pre-defined attacks, capabilities will provide lower-level building blocks to enable users to create their own adaptive attacks that can be customized to the specific AI model under test. Capabilities will provide users with the ability to control the attack severity and assess performance given varying assumptions on adversary knowledge and adversary capabilities.

• Software will be usable as libraries within python environments.
• Software will be straightforward to run on a wide range of deployment environments, including all major operating systems, cloud deployments, etc.
• Where appropriate, software will allow users to add functions (e.g., custom metrics, perturbations, adversarial attacks) in an extensible way.
• Where appropriate, software may build upon existing open-source libraries, increasing their maturity, compatibility, or relevancy for DoD usage.
• Software will be designed to enable continual evolution with the state-of-the-art in AI T&E and updates in ML technologies. In particular, software will be designed to enable straightforward contributions from developers in the community.

• Software must address compatibility and integration. Example ML technologies to consider compatibility with include (but are not limited to):
  
  • ML frameworks: PyTorch, TensorFlow
  • ML pipelines: Databricks, SageMaker, Vertex
  • Compute engines: Kubernetes, Spark, Ray
  • Orchestrators: Airflow, Kubeflow, Pachyderm
  • Scalability frameworks: Horovod, PyTorch Lightning
• Development shall place heavy emphasis on diligent API design in order to enable straightforward compatibility with a wide range of technologies.

Government will have at least full rights to software developed within this award, including access, distribution, and modification. The government is not interested in licensing; any solution that requires licensing or has more limited intellectual property rights will not be considered. 

Interested parties will collaborate with the government and other developers in order to create a set of interoperable T&E capabilities. In particular, API design and dependency management will require detailed collaboration to ensure compatibility.

Round 1 is a review to down-select based on the technical strength of written responses. Round 1 is evaluated to explore expertise available (who understands the problem set the best?) and find technically excellent ideas (who has an effective approach to solving the problem?). Review during round 1 is highly subjective. After an initial evaluation of written responses, select parties will be invited to deliver a presentation to a government panel on their proposed technical approach.

Round 2: Technical Presentation

This is your chance to present your technical approach to the government panel. Participants will have 45 minutes to present and 15 minutes for questions from the panel. Questions will be relevant to the information provided in the presentation and may differ among presenters. There is no formal agenda or schedule to the demo outside of the time constraint. The Presenter has complete control over the structure and format of the 45-minute presentation. Any organizational descriptions and introductory company remarks should be kept to a minimum.

The Government panel will possess a high level of familiarity with AI T&E; thus, the presentation should clearly address the technical details of the approach. If invited to this phase, additional logistical information (i.e., time, date, and dimensions of interest) will be provided separately.

Special Notice on Judges: 

Non-Government, subject matter expert (SME) judges may be used any assessment activity. Such assessors will be operating at the direction of the Government and through signed non-disclosure agreements (NDAs). The Government understands that information provided in response to this challenge is presented in confidence and it agrees to protect such information from unauthorized disclosure to extent required by law. Your participation in any round of assessment under this Challenge indicates concurrence with the use of Non-Government SME judges.