MLARM cheat sheet

Supervised learning minimizes expected loss over a joint distribution P(X,Y); empirical risk uses the training sample, and generalization gap = test error − training error.

Bias-variance decomposition: expected squared error = bias² + variance + irreducible noise; increasing model capacity lowers bias and raises variance.

Risk = likelihood × impact; inherent risk is measured before controls, residual risk after controls, and control effectiveness = (inherent − residual) / inherent.

Overfitting indicators: large train-validation gap, validation loss rising while training loss falls, and high sensitivity to resampling.

Model risk arises from (1) incorrect or misapplied methodology, (2) bad data, (3) inappropriate use, and (4) implementation/IT failure; each needs a distinct control.

Precision = TP/(TP+FP); recall = TP/(TP+FN); F1 = harmonic mean of the two; ROC-AUC is threshold-independent, PR-AUC is preferred for rare positives.

Cross-validation with k folds gives a lower-variance error estimate than a single holdout; time-series data requires forward-chaining splits to avoid leakage.

A risk appetite statement sets tolerances; risk tiering (high/medium/low) drives validation depth, monitoring frequency, and approval level.

Three-lines model: first line owns the model, second line (risk/compliance/validation) challenges independently, third line (internal audit) provides assurance.

EU AI Act risk tiers: prohibited practices, high-risk systems (Annex III uses), limited-risk with transparency duties, minimal-risk; GPAI models carry separate documentation and copyright obligations.

High-risk AI Act obligations include risk management system, data governance, technical documentation, logging, human oversight, accuracy/robustness/cybersecurity, and post-market monitoring.

US federal banking agencies' SR 11-7 requires model inventory, validation, ongoing monitoring, and governance; it applies to models, not to tools excluded by the definition.

Model inventory fields: unique ID, owner, purpose, tier, inputs/outputs, dependencies, validation status, last review date, and approval record.

Regulatory mapping rule: one control can satisfy multiple obligations, but each obligation must trace to at least one tested control (obligation-to-control traceability matrix).

NIST AI RMF functions: Govern, Map, Measure, Manage - Govern is cross-cutting; ISO/IEC 42001 specifies an AI management system with continual improvement (Plan-Do-Check-Act).

Board-level governance needs a named accountable executive, documented AI policy, escalation paths, and periodic reporting of model risk metrics.

Data quality dimensions: completeness, accuracy, consistency, timeliness, uniqueness, validity - each needs a measurable threshold and an owner.

Train-serve skew occurs when feature computation differs between training pipeline and production; detect by comparing feature distributions and recomputation parity tests.

Leakage types: target leakage (features unavailable at prediction time) and train-test contamination; both inflate offline metrics relative to production.

Privacy techniques: de-identification/pseudonymization, k-anonymity, l-diversity, differential privacy (ε budget), and federated learning; re-identification risk persists with quasi-identifiers.

GDPR principles: lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity/confidentiality, accountability.

Adversarial threats to ML: data poisoning, evasion/perturbation attacks, model inversion, membership inference, and model extraction; mitigations include adversarial training, input validation, and rate limiting.

PII handling controls: classification labels, encryption at rest and in transit, tokenization, access logging, retention schedules, and data processing agreements with vendors.

Synthetic data must be validated for fidelity and privacy leakage (nearest-neighbor distance tests) before substituting for real data in model training.

Model documentation (model card) sections: intended use, limitations, training data, features, performance by segment, ethical considerations, and owners.

Validation independence: effective challenge requires the validator to be organizationally separate from the developer and empowered to reject the model.

Validation components: conceptual soundness, data quality review, outcomes analysis (backtesting, benchmarking), implementation testing, and ongoing monitoring plan.

Backtesting compares model predictions to realized outcomes; benchmarking compares the model to an alternative approach (champion-challenger).

Feature engineering controls: documented transformations, versioned feature store, point-in-time correctness, and reproducible pipelines (seeds, environment pinning).

Hyperparameter tuning must occur inside the training fold; tuning on the validation set used for selection biases reported performance.

Reproducibility requires versioned code, data snapshots, environment/container hashes, and recorded random seeds; without all four, results cannot be re-derived.

Model approval gate: validation report sign-off, limitations accepted in writing, monitoring thresholds set, and deployment rollback plan documented.

Covariate (feature) drift: P(X) changes, P(Y|X) stable; label drift: P(Y) changes; concept drift: P(Y|X) changes and the learned relationship decays.

Drift detection tests: PSI (rule of thumb <0.1 stable, 0.1–0.25 moderate, >0.25 significant), KS test, chi-square for categoricals, and population-level distance metrics.

Monitoring layers: data quality/integrity, feature and prediction distributions, performance metrics against delayed ground truth, and business outcome metrics.

Performance degradation without drift can occur from upstream schema changes, pipeline bugs, or changed user behavior; monitor inputs and outputs jointly.

Alert design: thresholds tied to materiality, minimum sample size before testing, suppression windows, and a defined owner plus escalation path per alert.

Champion-challenger and shadow deployment allow comparison of a new model on live traffic without affecting customers.

Backtest decay: performance measured on rolling windows reveals stability; a single aggregate metric can hide segment-level deterioration.

Retraining triggers include scheduled cadence, drift threshold breach, performance breach, and material change in business use or data source.

Global vs local explanation: global describes overall model behavior (feature importance, PDP); local explains one prediction (SHAP values, LIME, counterfactuals).

SHAP values are Shapley values from cooperative game theory; they are additive and sum to the prediction minus the base value, but are computationally costly and correlated features can distort attribution.

Permutation importance measures the drop in performance when a feature is shuffled; it is model-agnostic but misleading with correlated features.

Fairness metrics: demographic parity (equal positive rates), equalized odds (equal TPR and FPR across groups), predictive parity (equal PPV), and calibration within groups.

Fairness metric incompatibility: except in degenerate cases, demographic parity, equalized odds, and predictive parity cannot all hold simultaneously.

Bias sources: historical/societal bias in labels, representation bias in sampling, measurement bias in proxies, and deployment bias from use context.

Proxy variables (ZIP code, name, language) can transmit protected-class information even when the protected attribute is excluded from features.

Explainability obligations differ by audience: regulators need documented rationale and validation evidence; customers need plain-language adverse-action reasons; developers need diagnostics.

Lifecycle stages: ideation, development, validation, approval, deployment, monitoring, change management, decommissioning - each with entry/exit criteria and named owners.

Third-party model risk requires due diligence, contractual audit and notification rights, exit strategy, concentration assessment, and ongoing performance evidence from the vendor.

Change management: material changes (new data source, retraining methodology, use expansion) require revalidation; minor changes follow a documented light-touch path.

Model decommissioning controls: revoke credentials, archive code/data/validation records for the retention period, update inventory status, and confirm dependent processes migrated.

Operational failure modes: pipeline outages, stale features, schema drift, credential expiry, and undocumented manual overrides - each needs a detection control.

Concentration risk arises when one vendor, data provider, or platform supports many critical models; map dependencies to identify single points of failure.

Incident management for models: severity classification, containment (rollback or fallback model), root-cause analysis, and lessons-learned updates to controls.

Fourth-party risk (vendor's subcontractors) and cloud data residency must be assessed where the model or its data crosses jurisdictions.

Responsible AI principles commonly cited: fairness, transparency, accountability, privacy, safety/robustness, and human oversight; principles require operational controls to be meaningful.

Human-in-the-loop vs human-on-the-loop: the first requires approval per decision, the second requires monitoring with intervention capability; the choice depends on impact and reversibility.

Generative AI risks: hallucination, prompt injection, training-data memorization, copyright exposure, and uncontrolled tool/agent actions.

RAG grounding and citation reduce hallucination but do not eliminate it; retrieval quality and source authority must be monitored.

Agentic AI adds autonomy risk: scope of permitted actions, least-privilege tool access, action logging, and hard stop controls.

Environmental and societal impact reporting covers compute/energy use, labor displacement, and accessibility; disclosure expectations are maturing rather than settled.

Model cards and system cards are transparency artifacts; they support accountability only when accurate and kept current through change management.

Emerging regulation trends: AI system registries, conformity assessment, transparency for synthetic content, and incident reporting duties for serious events.