Summary: NIST’s seven properties of trustworthy AI, with the security-relevant definitions verbatim. The framework’s key claim is that these trade off against each other and must be balanced, not maximised individually.
Sources: raw/Laws/NIST.AI.100-1.md (Section 3)
Last updated: 2026-07-28
The seven
- Valid and Reliable
- Safe
- Secure and Resilient
- Accountable and Transparent
- Explainable and Interpretable
- Privacy-Enhanced
- Fair – with Harmful Bias Managed
3.3 Secure and Resilient — verbatim
AI systems, as well as the ecosystems in which they are deployed, may be said to be resilient if they can withstand unexpected adverse events or unexpected changes in their environment or use – or if they can maintain their functions and structure in the face of internal and external change and degrade safely and gracefully when this is necessary. Common security concerns relate to adversarial examples, data poisoning, and the exfiltration of models, training data, or other intellectual property through AI system endpoints. AI systems that can maintain confidentiality, integrity, and availability through protection mechanisms that prevent unauthorized access and use may be said to be secure. Guidelines in the NIST Cybersecurity Framework and Risk Management Framework are among those which are applicable here.
Security and resilience are related but distinct characteristics. While resilience is the ability to return to normal function after an unexpected adverse event, security includes resilience but also encompasses protocols to avoid, protect against, respond to, or recover from attacks. Resilience relates to robustness and goes beyond the provenance of the data to encompass unexpected or adversarial use (or abuse or misuse) of the model or data.
(source: NIST.AI.100-1.md)
The security/resilience distinction is worth keeping: resilience is recovery, security is the full avoid/protect/respond/recover set. Security ⊃ resilience.
Note the same three attack classes NIST names here — adversarial examples, data poisoning, model/data exfiltration — appear almost verbatim in AI Act Art 15(5). The Act’s list is the adversarial-ML canon, and NIST is where it comes from.
3.1 Valid and Reliable — the accuracy/robustness tension
Validation: “confirmation, through the provision of objective evidence, that the requirements for a specific intended use or application have been fulfilled” (ISO 9000:2015).
Robustness / generalizability: “the ability of a system to maintain its level of performance under a variety of circumstances” (ISO/IEC TS 5723:2022). It “requires not only that the system perform exactly as it does under expected uses, but also that it should perform in ways that minimize potential harms to people if it is operating in an unexpected setting.”
NIST states plainly that “Accuracy and robustness contribute to the validity and trustworthiness of AI systems, and can be in tension with one another” (source: NIST.AI.100-1.md).
Also: accuracy measurements “should always be paired with clearly defined and realistic test sets… and details about test methodology,” and “may include disaggregation of results for different data segments.”
3.2 Safe
Systems should “not under defined conditions, lead to a state in which human life, health, property, or the environment is endangered” (ISO/IEC TS 5723:2022). Practical approaches “often relate to rigorous simulation and in-domain testing, real-time monitoring, and the ability to shut down, modify, or have human intervention into systems that deviate from intended or expected functionality.”
“Safety risks that pose a potential risk of serious injury or death call for the most urgent prioritization.”
3.4 Accountable and Transparent
“Trustworthy AI depends upon accountability. Accountability presupposes transparency.” Transparency spans “design decisions and training data to model training, the structure of the model, its intended use cases, and how and when deployment, post-deployment, or end user decisions were made and by whom,” and “is often necessary for actionable redress.”
The balancing claim
The framework’s central methodological point:
Trustworthiness characteristics explained in this document influence each other. Highly secure but unfair systems, accurate but opaque and uninterpretable systems, and inaccurate but secure, privacy-enhanced, and transparent systems are all undesirable. A comprehensive approach to risk management calls for balancing tradeoffs among the trustworthiness characteristics.
(source: NIST.AI.100-1.md)
And on how to resolve them: “These analyses can highlight the existence and extent of tradeoffs between different measures, but they do not answer questions about how to navigate the tradeoff. Those depend on the values at play in the relevant context and should be resolved in a manner that is both transparent and appropriately justifiable.”
Three concrete trade-offs visible elsewhere in this corpus:
- Privacy vs forensics — “Forensic-grade telemetry may conflict with privacy-by-design defaults” (source:
raw/AI-incident-response/Incident response for AI systems.md). See Microsoft IR readiness. - Transparency vs security — publishing model documentation aids downstream compliance and aids attackers. The Act resolves this with Art 78 confidentiality and trade-secret protections.
- Openness vs control — open weights defeat model-level safety controls entirely. See weight-level attacks.
Role-dependence
“Understanding and treatment of trustworthiness characteristics depends on an AI actor’s particular role within the AI lifecycle. For any given AI system, an AI designer or developer may have a different perception of the characteristics than the deployer.”
This is the same role-relativity the AI Act encodes structurally — see provider vs deployer.
Comparison across frameworks
| NIST characteristic | OECD principle | Singapore | AI Act article |
|---|---|---|---|
| Secure and Resilient | 1.4 Robustness, security and safety | Robustness (2nd ed.) | Art 15 |
| Accountable and Transparent | 1.3, 1.5 | Explainable, Transparent & Fair | Arts 13, 50 |
| Explainable and Interpretable | 1.3 | Explainable | Art 13 |
| Fair – bias managed | 1.2 | Fair | Art 10 |
| Privacy-Enhanced | 1.2 | (PDPC context) | Art 10, GDPR |
| Safe | 1.4 | Human-centric | Art 9 |
See oecd-ai-principles, singapore-model-framework.