Building Trust in Artificial Intelligence: A Necessity for Railway Applications

# Building Trust in Artificial Intelligence: A Necessity for Railway Applications
Source: [https://arxiv.org/html/2609.18278](https://arxiv.org/html/2609.18278)
Lébé VincentDa Silva Ribeiro Pereira RicardoSundell JohanJaoul ArnaudSaiah KenzaMijatović Nenad

###### Abstract

AI\(AI\) is currently only applied to non\-safety critical applications due to the strict standards and regulations for railway industries\. We propose to review the three main fields necessary to increase trust in data science andAIalgorithms and reach compliance: robustness,ODD\(ODD\), and explainability\. Robustness is the ability of anAIsystem to maintain its level of performance under any circumstances \(ISO24029\)\.ODDs allow the explicit definition of operating conditions under which a system is intended to operate, according to the recently published DIN DKE SPEC 99004\. Explainability is the property of anAIsystem to express important factors influencing theAIsystem results in a way that humans can understand\. Those 3 domains of research are already well investigated by non\-railway actors, with algorithms and methods ready to use for railway applications\. A system view is necessary to ensure all trustworthy requirements interact continuously in a safe MLOps environment thereby fostering acceptance from regulators, operators and the public\. Beyond safeguarding safety\-critical applications, we aim to show that fostering deep trust inAI, as now required by regulatory frameworks worldwide, will unlock its full potential and transform the pace of adoption across mission\-critical domains\.

1Alstom \- Mobility Data Science and AI, Madrid, Spain

2Alstom \- Mobility Data Science and AI, Saint\-Ouen, France

3Alstom \- Safety Engineering, Stockholm, Sweden

4Alstom \- Chief AI & Data Science Office, Pittsburgh, Pennsylvania USA

Keywords

Artificial Intelligence, Railway, Transportation, Mobility, Trust, Safety\.

## 1 Introduction

The levers of trust needed forAI, as described by Bo Li et al\.\[[22](https://arxiv.org/html/2609.18278#bib.bib4)\]\(\[[22](https://arxiv.org/html/2609.18278#bib.bib4)\]\), are: Robustness, Explainability, Transparency, Reproducibility, Generalization, Fairness, Privacy and Accountability\. The theoretical framework they propose towards a more TrustworthyAIis very complete and valuable, as models are increasingly impacting our way of working\. This work addresses the industrial gaps of the railway industry to deployAIat scale, including in safety\-related projects\. Our paper focuses on the three domains where research is necessary to unlock deployingAIwhen trust is paramount: Robustness, Explainability,ODD\(ODD\)\. This publication uses the terminology presented in the ISO22989\[[16](https://arxiv.org/html/2609.18278#bib.bib2)\]\(2022\), where ”AI system” is defined in this standard as an engineered system that generates outputs such as content, forecasts, recommendations or decisions for a given set of human\-defined objectives\.

### 1\.1 Regulatory Landscape

The regulatory environment forAIin the railway sector is evolving rapidly, and is shaped by both sector\-specific safety standards and cross\-sectoralAIregulations\. A key development is the EUAIAct, defined as Regulation \(EU\) 2024/1689\[[44](https://arxiv.org/html/2609.18278#bib.bib12)\], which introduces a risk\-based classification ofAIsystems into the following four categories: Unacceptable risk \(e\.g\., social scoring\), High risk \(e\.g\.,AIin safety functions or critical infrastructure\), Specific transparency obligations \(e\.g\., bots, deepfakes\), Minimal or no risk\. Given the increasing use ofAIin predictive maintenance, autonomous train operations, and safety\-critical systems, many railway applications fall under the high\-risk category\. This classification imposes stringent requirements for transparency, traceability, and human oversight, makingxAI\(xAI\) not only a compliance necessity but also a valuable tool to better understand subsystems\. To support these regulatory demands, several international standards and technical reports provide foundational guidance:

- •ISO/IEC TR5469:2024\[[17](https://arxiv.org/html/2609.18278#bib.bib7)\]\(\[[17](https://arxiv.org/html/2609.18278#bib.bib7)\]\) plays a crucial interim role by offering practical guidance on the use ofAIin safety\-related systems while the more detailed ISO/IEC TS22440 is under development\. It addresses the functional safety ofAIsystems, particularly in E/E/PE safety\-related systems, and introduces a three\-stage realization principle \(data acquisition, knowledge induction, and output generation\)\. and mitigation strategies tailored to AI\.
- •IEC61508\[[8](https://arxiv.org/html/2609.18278#bib.bib3)\]\(2010\), the cornerstone standard for functional safety of electrical / electronic / programmable electronic \(E/E/PE\) systems, provides the conceptual backbone for ISO/IEC TR5469\. Many of the safety principles, such as risk reduction, ALARP \(As Low As Reasonably Practicable\), and positive risk balance, are adapted and extended to address the unique characteristics ofAIsystems\.
- •ISO/IEC22989\[[16](https://arxiv.org/html/2609.18278#bib.bib2)\]\(2023\) emphasizes explainability, ensuringAIdecisions are interpretable by humans\.
- •ISO/IEC24029\[[2](https://arxiv.org/html/2609.18278#bib.bib13)\]\(\[[2](https://arxiv.org/html/2609.18278#bib.bib13)\]\) focuses on robustness, defining it as theAIsystem’s ability to maintain performance under varying conditions\.
- •DIN DKE SPEC 99004\[[10](https://arxiv.org/html/2609.18278#bib.bib36)\]\(\[[10](https://arxiv.org/html/2609.18278#bib.bib36)\]\) introduces the concept of Operational Design Domains \(ODD\), specifying the operational boundaries forAIsystems\.

ISO/IEC TR5469 also highlights the limitations of traditional software assurance methods when applied to AI, such as the inapplicability of code coverage metrics and the challenge of verifying non\-deterministic, data\-driven models\. It advocates for architectural safeguards, robust learning techniques, and runtime monitoring to mitigate AI\-specific risks\. In summary, legal frameworks like the EUAIAct provide compliance obligations and technical standards provide methodological tools\. Those are not sufficient to state clear guidelines for AI compliance in railway safety critical applications, hence a growing pressure from all the stakeholders to clarify the requirements\.

### 1\.2 Safety Integrity Level

SIL\(SIL\) is used to evaluate and specify the safety requirements for critical system functions within railway operations and introduces a probabilistic safety approach\. TheSILrating system appears in several standards applicable on railway solutions, for instance in IEC61508\[[8](https://arxiv.org/html/2609.18278#bib.bib3)\]\(2010\) for electrical, electronic and programmable electronic \(E/E/PE\) systems or in EN50126\[[4](https://arxiv.org/html/2609.18278#bib.bib9)\]\(\[[4](https://arxiv.org/html/2609.18278#bib.bib9)\]\), EN50716\[[6](https://arxiv.org/html/2609.18278#bib.bib8)\]\(\[[6](https://arxiv.org/html/2609.18278#bib.bib8)\]\), and EN50129\[[5](https://arxiv.org/html/2609.18278#bib.bib10)\]\(\[[5](https://arxiv.org/html/2609.18278#bib.bib10)\]\) for safe software development in European Railway Applications\. TheSILlevel and its tolerable hazard rate associated are described in Table[1](https://arxiv.org/html/2609.18278#S1.T1)\.

Table 1:Safety Integrated LevelsPeter Wigger \(\[[48](https://arxiv.org/html/2609.18278#bib.bib11)\]\)\[[48](https://arxiv.org/html/2609.18278#bib.bib11)\]presents several examples of Railway applicationsSILlevels on the Copenhagen Metro subsystems, where some functions of the ATP \(Automatic Train Protection\) such as the interlocking and speed profile control are SIL4 while the vehicles door management is SIL3\. A SIL4 solution would translate into allowing a failure every 100 000 years, which corresponds to the highest level of safety\.

WhileAImodels typically aim for 80–99% accuracy, this falls short of the stringent tolerable hazard rates required bySILstandards\. Even high\-performing models remain vulnerable to previously unseen out\-of\-distribution data\. Current standards do not fully address AI\-specific challenges, especially in safety\-critical domains like railways, making compliance assessment difficult and underscoring the need for dedicatedAIsafety specifications\. In operational settings like maintenance analysis, users can benefit from understandingAIoutputs, as proposed by Di\-Santi et al\. \(\[[35](https://arxiv.org/html/2609.18278#bib.bib43)\]\) for the predictive maintenance of track circuits\[[23](https://arxiv.org/html/2609.18278#bib.bib42)\]\[[32](https://arxiv.org/html/2609.18278#bib.bib44)\]and point machines\[[35](https://arxiv.org/html/2609.18278#bib.bib43)\]using neural networks\. However, in safety\-critical scenarios such as an obstacle detected on rails, lives are at stake, leaving no room for errors\. In such cases, trust in the system and higher Safety Integrity Levels \(SIL\) becomes essential, which is why AI is not used currently\. This publication describes the need for research to design robustAIsystems embedded inSILenvironments\.

## 2 Robustness ofAISystems

### 2\.1 Definition and context

Robustness refers to the ability of anAIsystem to maintain its level of performance under any circumstances \(ISO24029\[[2](https://arxiv.org/html/2609.18278#bib.bib13)\],\[[2](https://arxiv.org/html/2609.18278#bib.bib13)\]\)\. This concept addresses the extent to which the system performs under expected and unseen perturbations in input data due to various operational environments\. In the railway context, this means that system performance must be maintained across diverse and potentially harsh conditions \(such as lighting, weather, …\)\. Collecting diverse and representative data is often difficult due to infrastructure constraints, privacy concerns, or the rarity of edge\-case scenarios\. As a result, models trained on limited data may become highly sensitive to out\-of\-distribution inputs\.

In the AI literature, generalization and robustness are separate concepts\. Generalization refers to the ability of a model to perform well on unseen data, whereas robustness is mainly defined as a per\-input property, meaning that a model is robust if it does not change its output for a specified set of perturbations on a given input\[[43](https://arxiv.org/html/2609.18278#bib.bib19),[13](https://arxiv.org/html/2609.18278#bib.bib14)\]\.

### 2\.2 Adversarial robustness

In the field of evaluating the robustness of machine learning models, adversarial examples are gathering more and more interest from the community\[[13](https://arxiv.org/html/2609.18278#bib.bib14),[14](https://arxiv.org/html/2609.18278#bib.bib18),[43](https://arxiv.org/html/2609.18278#bib.bib19),[3](https://arxiv.org/html/2609.18278#bib.bib5),[33](https://arxiv.org/html/2609.18278#bib.bib6)\]\. An adversarial example is a deliberately crafted sample to fool the model’s output by adding small but carefully structured perturbations to a given input, which may or may not be perceptible to humans \(see Figure[1](https://arxiv.org/html/2609.18278#S2.F1)\)\.

![Refer to caption](https://arxiv.org/html/2609.18278v1/images/stop_sign.png)Figure 1:Example of adversarial attack on signaling classification from\[[18](https://arxiv.org/html/2609.18278#bib.bib41)\]\.This questions the potential use of models in safety\-critical systems and introduces challenges that complicate regulatory approval for AI\-based systems\. Evaluating adversarial robustness refers to the evaluation of the system’s resilience and whether the amount of perturbation needed to create the adversarial examples is sufficiently large, either so that it becomes perceptible to humans, or so that it reasonably justifies the model’s error\. As an initial step towards ensuring robustness, it is crucial to verify that the adversarial examples identified involve a level of perturbation that makes the model misclassification understandable\. When trying to address adversarial robustness, two major strategies have emerged from the community: \(1\) empirical defenses that consist of architectural changes or training the model with adversarial examples, to empirically improve the robustness against adversarial attacks\[[25](https://arxiv.org/html/2609.18278#bib.bib21),[11](https://arxiv.org/html/2609.18278#bib.bib48)\], \(2\) certified defenses that provide formal guarantees of the model’s robustness against input perturbations\. A certificateccis usually formally defined for a given inputxxas:

∀δ,‖δ‖<c⟹f⁡\(x\)=f⁡\(x\+δ\)\\forall\\delta,\\quad\\\|\\delta\\\|<c\\implies f\(x\)=f\(x\+\\delta\)wheref⁡\(x\)f\(x\)refers to the model’s output\.

Certified defenses are therefore a relevant way to assess the robustness of a model in a safety\-critical environment\. To achieve that, several approaches are being developed such as randomized smoothing\[[7](https://arxiv.org/html/2609.18278#bib.bib20)\]providing probabilistic certificates and formal verification methods\[[19](https://arxiv.org/html/2609.18278#bib.bib45),[47](https://arxiv.org/html/2609.18278#bib.bib46)\]\. Another approach is Lipschitz neural networks\[[1](https://arxiv.org/html/2609.18278#bib.bib25)\]that are showing promising results by controlling the Lipschitz constant of the model \(see Definition[1](https://arxiv.org/html/2609.18278#Thmdefinition1)\)\.

###### Definition 1\(Lipschitz Continuity\)

A functionf:ℝn→ℝmf:\\mathbb\{R\}^\{n\}\\rightarrow\\mathbb\{R\}^\{m\}is said to beLipschitz continuousif there exists a constantK≥0K\\geq 0such that for allx1,x2∈ℝnx\_\{1\},x\_\{2\}\\in\\mathbb\{R\}^\{n\},

‖f⁡\(x1\)−f⁡\(x2\)‖≤K​‖x1−x2‖\.\\\|f\(x\_\{1\}\)\-f\(x\_\{2\}\)\\\|\\leq K\\\|x\_\{1\}\-x\_\{2\}\\\|\.\(1\)The smallest such constantKKis called theLipschitz constantofff, denotedLip⁡\(f\)\\operatorname\{Lip\}\(f\)\.

To build Lipschitz neural networks, several methods can be used\[[30](https://arxiv.org/html/2609.18278#bib.bib47),[1](https://arxiv.org/html/2609.18278#bib.bib25),[37](https://arxiv.org/html/2609.18278#bib.bib22)\]\. In practice, one can use libraries like DEEL\-Lip\[[37](https://arxiv.org/html/2609.18278#bib.bib22)\]to build such networks\. Bounding the Lipschitz constant of neural networks has been shown to improve robustness against adversarial attacks, generalization, and interpretability\[[15](https://arxiv.org/html/2609.18278#bib.bib23),[40](https://arxiv.org/html/2609.18278#bib.bib24),[37](https://arxiv.org/html/2609.18278#bib.bib22),[46](https://arxiv.org/html/2609.18278#bib.bib49)\]\.

Combining this approach with adversarial attacks leads to both a lower bound and an upper bound of the true robustness of the model on a given input\. These certificates can be used to certify a prediction and, when the bound is too low, trigger fallback mechanisms, use more computationally expensive methods, such as formal methods, or human intervention to ensure safe operation\.

## 3 Explainability

### 3\.1 Definition and examples

Explainability is defined in the ISO22989 \(2022\)\[[16](https://arxiv.org/html/2609.18278#bib.bib2)\]as ”the property of anAIsystem to express important factors influencing theAIsystem results in a way that humans can understand”\. This definition is human\-centric, underscoring the importance of makingAIsystems transparent to all stakeholders and not only the engineers developing it\. ExplainableAIalgorithms are already used for production\-grade models to provide insights for the data scientists or the business experts into what the model focused on, and to support debugging and validation tasks\. GlobalxAIexplain how a model behaves in general and localxAIexplain the reasons behind a specific prediction\.

Lee et al\. \(\[[21](https://arxiv.org/html/2609.18278#bib.bib31)\]\)\[[21](https://arxiv.org/html/2609.18278#bib.bib31)\]present an example of global interpretability of a model predicting the preference between using an express or a local train from 9 features, using SHAP \(\[[24](https://arxiv.org/html/2609.18278#bib.bib32)\]\)\[[24](https://arxiv.org/html/2609.18278#bib.bib32)\], a feature attribution algorithm\. Figure[2](https://arxiv.org/html/2609.18278#S3.F2)\(a\) shows the 9 features, ranked by importance\. Each point represents one sample on which the model does a prediction and gets a local interpretability with Shapley values \(\[[38](https://arxiv.org/html/2609.18278#bib.bib40)\]\)\[[38](https://arxiv.org/html/2609.18278#bib.bib40)\]expressing the feature´s contribution, as detailed in Figure[2](https://arxiv.org/html/2609.18278#S3.F2)\. The local interpretability values of all samples are plot all together\. The scale on the right shows the point´s feature values: purple is a high value of the feature, yellow is low\. The X\-axis represents the impact on model output, negative or positive\. In that case, a negative value lowers the output probability of taking an express train, while a positive value raises it\. Engineers could draw conclusions from XAI, such as: the longer the trip, the more likely a passenger is to take an express train according to the model\.

Figure[2](https://arxiv.org/html/2609.18278#S3.F2)\(b\) is an example of local explainability, of an image classified as a train from Stalder et al\. \(\[[42](https://arxiv.org/html/2609.18278#bib.bib39)\]\)\[[42](https://arxiv.org/html/2609.18278#bib.bib39)\]\. GradCAM\[[36](https://arxiv.org/html/2609.18278#bib.bib38)\], a post\-hoc attribution algorithm, shows the pixel the algorithm focused on to classify\. The more red the pixel is, the more important it is for the computer vision classifier \(in our example, the algorithm focused on the boggie of the train\)\. Local explainability methods are used in the railway industry on production\-grade algorithms, such as the detection and recognition of wayside signals by Staino et al\. \(\[[41](https://arxiv.org/html/2609.18278#bib.bib34)\]\)\[[41](https://arxiv.org/html/2609.18278#bib.bib34)\]or the detection and classification of wheel tread defects based pictures by Trilla et al\. \(\[[45](https://arxiv.org/html/2609.18278#bib.bib35)\]\)\[[45](https://arxiv.org/html/2609.18278#bib.bib35)\]\. In railway systems, apart from being a necessity to understand complex models, explainability is leveraged for new use cases such as root cause analysis for incident investigation\.

![Refer to caption](https://arxiv.org/html/2609.18278v1/images/shap_express.png)\(a\)Global explainability of an express train classifier\[[21](https://arxiv.org/html/2609.18278#bib.bib31)\]
![Refer to caption](https://arxiv.org/html/2609.18278v1/images/boggie_train_xai.png)\(b\)Local explainability of a classified train\[[42](https://arxiv.org/html/2609.18278#bib.bib39)\]

Figure 2:Global and local explainabilityBoth global and local explanations are necessary to provide engineers and users insights on the system they are building\.

### 3\.2 Methods and limitations

Many state of the art publications list the methods for explainableAIvery well, notably Molnar \(\[[31](https://arxiv.org/html/2609.18278#bib.bib27)\]\)\[[31](https://arxiv.org/html/2609.18278#bib.bib27)\]providing a deep review of algorithms for tabular Machine Learning, the unified comprehensive review of Minh et all \(\[[29](https://arxiv.org/html/2609.18278#bib.bib30)\]\)\[[29](https://arxiv.org/html/2609.18278#bib.bib30)\]and more recently Enemona et al\. \(\[[26](https://arxiv.org/html/2609.18278#bib.bib28)\]\)\[[26](https://arxiv.org/html/2609.18278#bib.bib28)\]on the emerging techniques in 2025\.

Minh et all\[[29](https://arxiv.org/html/2609.18278#bib.bib30)\]describe three groups of methods : \(i\) pre\-modeling explainability to ensure transparency in data preparation and feature selection \(ii\) interpretable model, which are transparent by design \(such as decision trees, linear models, and rule\-based systems\) and \(iii\) post\-modeling explainability, refering to methods applied after a model has been trained, particularly for complex or black\-box models \(for example SHAP for tabular data or Saliency maps for Computer Vision\)\. Fel et all\[[12](https://arxiv.org/html/2609.18278#bib.bib29)\]gathered the most important methods of the state of the art in a single package: Xplique, which facilitates the adoption\. By providing a consistent interface with XAI algorithms, the unified framework promotes reproducibility and comparability across studies\. Both SHAP and Gradcam, used for the example of Figure[2](https://arxiv.org/html/2609.18278#S3.F2), are accessible\.

However, we would like to highlight that even if the research on XAI algorithms seems quite avanced, there are still important gaps before XAI becomes an enabler for implementation in safety\-related areas\. The research community is more focused on computer vision use cases than on tabular or time series applications, which are highly important in the railway industry\. The current state of the art presents hypothesis that must be understood and tracked if explaination becomes a safety or a regulation requirement\. Indeed, post\-modeling explainability algorithms are a representation of the model´s reasoning, not the reality\. For instance, one could expect the features presented in Figure[2](https://arxiv.org/html/2609.18278#S3.F2)\(a\) to be quite correlated… and computing explainations with SHAP when features are correlated is likely to provide an interpretation not representing well the model´s decision making process, as widely covered by the literature and by\[[31](https://arxiv.org/html/2609.18278#bib.bib27)\]\. So mathematical hypothesis should be tracked and verified if one is to provide trust on a model´s explainability\.

The only safe way to ensure an explanation given is trustworthy as of now is to use a model interpretable by design, which is what is currently done in regulated areas where models take decision \(ex: an expert model for interlocking presented by Klein et al\. \(\[[20](https://arxiv.org/html/2609.18278#bib.bib33)\]\)\[[20](https://arxiv.org/html/2609.18278#bib.bib33)\]\)\)\. By using simple models such as linear regression or decision trees, engineers and auditors can be sure to fully understand and trust what´s behind the model decision, which is paramount for safety\-related projects\. Another relevant research path is causality, which aims to identify a direct link between an input and the model´s output\. By understanding cause\-and\-effect relationships in data rather than just identifying correlations, one can get back to the true reason behind an artificial intelligence reasoning\. However, this research domain is at its early stage and will need more maturity before being fully integrated in production products\.

## 4 Operational Design Domain

As per DIN DKE SPEC 99004\[[10](https://arxiv.org/html/2609.18278#bib.bib36)\]\(\[[10](https://arxiv.org/html/2609.18278#bib.bib36)\]\), theODD\(ODD\) in Rail is defined as an operational domain in which a givenAIsystem, or feature thereof, is specifically designed to function\. By clearly defining the boundaries,ODDhelp preventAIsystems from operating outside their safe zones, reducing risk and improving predictability\. Confiance\.AI provided a simple example ofODDfor their welding quality use case\[[9](https://arxiv.org/html/2609.18278#bib.bib37)\], where a model is used to detect welding defects on images\. Domain experts defined the acceptable conditions for image acquisition: Image brightness, rotation angles between \-30° and \+30°, translation of the piece in the image up to 5 millimeters\.

The DIN DKE SPEC 99004\[[10](https://arxiv.org/html/2609.18278#bib.bib36)\]details the steps to follow for the ODD´s lifecycle\. We propose to resume this lifecycle in Figure[3](https://arxiv.org/html/2609.18278#S4.F3)\.

![Refer to caption](https://arxiv.org/html/2609.18278v1/images/lifecycle_ODD.png)Figure 3:ODD Steps as per DIN DKE SPEC 99004\[[10](https://arxiv.org/html/2609.18278#bib.bib36)\]The research on ODD has been primarily driven by the Autonomous Driving field, which happens to use Artificial Intelligence in some specific cases\. We believe that what was done for Autonomous Driving could be applied to all A\.I use cases, which would bring more trust in all production algorithms\. The ODD concepts are already well defined and industrialized for autonomous driving, and all AI applications would benefit from the standardized requirements already guiding the development of autonomous vehicles\. Indeed, when reading the 10 purposes of an ODD presented in\[[10](https://arxiv.org/html/2609.18278#bib.bib36)\], one can identify attributes that are desirable for any AI system\. For instance: ”ODD limit detection: By defining an ODD one can develop algorithms to determine which sensing capabilities or data input are needed to detect when the AI System is inside and outside expected operating conditions\.” That statement would ring a bell to any data scientist who have been confronted to the issue of data drift\.

Data drift is defined as a significant change to the data distribution compared to the data used for training\. The model is then operating over a domain it has not been properly evaluated on, which may decrease the trust one could have over the results\. Many methods exist for data drift detection in an industrial context, as detailed by Simonetto et al\.\[[39](https://arxiv.org/html/2609.18278#bib.bib1)\]\(\[[39](https://arxiv.org/html/2609.18278#bib.bib1)\]\), ranging from statistical tests to uncertainty evaluation\. So detecting when the input data is different from the boundaries defined in theODDand the training data is feasible\. The issue is more on the actions taken after a drift identification: if a model retraining is required, then change management of theODDis also needed, which is costly and long\. Hence the need for the standardization and industrialization of ODD, to save engineering and validation time for changes\.

Overall,ODDis an important lever of trust forAIsolutions\. The strong added value ofODDhighlights the key need of system engineers when designingAIsolutions, and not only data scientists focusing on creating the best algorithms\.

## 5 A System Approach to Trustworthy AI

Rather than treating robustness, ODD, and explainability as isolated requirements, we advocate for a systemic approach where these elements interact continuously\. Those three pillars shall be integrated in operations to continuously monitorAIperformance and boundary conditions, and identify when a model shall be updated or not used at all\. System definitions are already defined in detail in the work of Confiance\.AI by Mattioli et al\. in several publications\[[28](https://arxiv.org/html/2609.18278#bib.bib15),[34](https://arxiv.org/html/2609.18278#bib.bib16),[27](https://arxiv.org/html/2609.18278#bib.bib17)\]\(\[[27](https://arxiv.org/html/2609.18278#bib.bib17)\]\)\.

We propose in Figure[4](https://arxiv.org/html/2609.18278#S5.F4)an approach where those three technological bricks are integrated into a classical Machine Learning flow \(in blue\): TheODDis defined after having acquired the right data and the robustness tests are performed on the model continuously\. In production, the ODD technologies are used to identify needs for changes in the ODD \(in green\) and take mitigation actions for specific samples\. The explainability bricks \(in orange\) are used by engineers to understand the model, globally in a training environment, then locally to understand each prediction of the production environment\.

![Refer to caption](https://arxiv.org/html/2609.18278v1/images/system.png)Figure 4:System approach using TrustworthyAItechnologiesTo do so, a safe MLOps \(Machine Learning Operations\) environment is necessary, as proposed by Zeller et al\.\[[49](https://arxiv.org/html/2609.18278#bib.bib26)\]\(\[[49](https://arxiv.org/html/2609.18278#bib.bib26)\]\), with a software infrastructure able to continuously assess and validate the trustworthiness of anAIin production without a human intervention\. This will faster development by simplifying the engineering workload of monitoring models in production and increase cross\-functional collaboration betweenAIdevelopers and safety engineers\. Such a system fosters trust not only from regulators but also from operators and the public, acceleratingAIadoption in mission\-critical railway applications\. A system approach is imperative if one wants to deployAIproducts in critical environments\.

## 6 Conclusion

By focusing on robustness,ODDandxAI—and integrating them into a systemic framework— we can pave the way for safe, compliant, and widely acceptedAIsystems\. Future work should focus on the development of certification frameworks and standards that establish the foundation to clear and exhaustive requirements for safety\-critical applications in railways\. Looking for algorithm compliance is not possible without the necessary norms to frame the use of AI\. Railways would benefit from cross\-industry collaboration to leverage their best practices and standards\. Several sectors are more advanced, such as the aerospace and automotive where engineers are already implementingAImodels in safety\-critical systems, supported by explicit requirements\. This publication does not exhaustively treat all key attributes needed for a trustworthy AI, which should operate ethically and safely, within a cyber\-secured environment and be supported by a strong data management system that correctly stores accurate data\. Only by being extremely precise over the complete life cycle ofAIwill we be able to deployAIin railway safety\-critical environments\.

## References

- \[1\]C\. Anil, J\. Lucas, and R\. Grosse\(2019\)Sorting out lipschitz function approximation\.InProceedings of the 36th International Conference on Machine Learning,K\. Chaudhuri and R\. Salakhutdinov \(Eds\.\),Vol\.97,pp\. 291–301\.External Links:[Document](https://dx.doi.org/10.48550/arXiv.1811.05381)Cited by:[§2\.2](https://arxiv.org/html/2609.18278#S2.SS2.p4.1),[§2\.2](https://arxiv.org/html/2609.18278#S2.SS2.p5.1)\.
- \[2\]\(2023\)Artificial Intelligence \(AI\) — Assessment of the robustness of neural networks — Part 1: Overview and Part 2: Methodology for the use of formal methods\.International Standard,International Organization for Standardization,Geneva, Switzerland\.Note:Available from https://www\.iso\.org/standard/77608\.htmlCited by:[4th item](https://arxiv.org/html/2609.18278#S1.I1.i4.p1.1),[§2\.1](https://arxiv.org/html/2609.18278#S2.SS1.p1.1)\.
- \[3\]N\. Carlini and D\. Wagner\(2017\)Towards Evaluating the Robustness of Neural Networks\.pp\. 39–57\.External Links:ISBN 978\-1\-5090\-5533\-3,[Document](https://dx.doi.org/10.1109/SP.2017.49)Cited by:[§2\.2](https://arxiv.org/html/2609.18278#S2.SS2.p1.1)\.
- \[4\]CENELEC\(1999\)EN 50126\-1:1999 Railway Applications – The Specification and Demonstration of Reliability, Availability, Maintainability and Safety \(RAMS\) – Part 1: Basic Requirements and Generic Process\.External Links:[Link](https://www.cenelec.eu/)Cited by:[§1\.2](https://arxiv.org/html/2609.18278#S1.SS2.p1.1)\.
- \[5\]CENELEC\(2018\)EN 50129:2018 Railway Applications – Communication, Signalling and Processing Systems – Safety Related Electronic Systems for Signalling\.External Links:[Link](https://www.cenelec.eu/)Cited by:[§1\.2](https://arxiv.org/html/2609.18278#S1.SS2.p1.1)\.
- \[6\]CENELEC\(2023\)EN 50716:2023 \- Railway applications – Software for communication, signalling and processing systems\.European Standard\.External Links:[Link](https://www.cenelec.eu/)Cited by:[§1\.2](https://arxiv.org/html/2609.18278#S1.SS2.p1.1)\.
- \[7\]J\. Cohen, E\. Rosenfeld, and Z\. Kolter\(2019\)Certified adversarial robustness via randomized smoothing\.InProceedings of the 36th International Conference on Machine Learning,Vol\.97,pp\. 1310–1320\.External Links:[Document](https://dx.doi.org/10.48550/arXiv.1902.02918)Cited by:[§2\.2](https://arxiv.org/html/2609.18278#S2.SS2.p4.1)\.
- \[8\]I\. E\. CommissionFunctional safety of electrical/electronic/programmable electronic safety\-related systems\.StandardTechnical ReportIEC 61508:2010\.External Links:ISBN 9782889109852,[Link](https://webstore.iec.ch/)Cited by:[2nd item](https://arxiv.org/html/2609.18278#S1.I1.i2.p1.1),[§1\.2](https://arxiv.org/html/2609.18278#S1.SS2.p1.1)\.
- \[9\]Confiance AI Team\(2025\)Welding quality detection challenge\.Note:[https://confianceai\.github\.io/Welding\-Quality\-Detection\-Challenge/](https://confianceai.github.io/Welding-Quality-Detection-Challenge/)Accessed: 2025\-07\-17Cited by:[§4](https://arxiv.org/html/2609.18278#S4.p1.1)\.
- \[10\]DIN \- Deutsches Institut für Normung e\.V\.\(2025\)DIN DKE SPEC 99004:2025\-05 \- Specification of Operational Design Domain in Rail\.DIN DKE\.Note:[https://dx\.doi\.org/10\.31030/3610746](https://dx.doi.org/10.31030/3610746)Cited by:[5th item](https://arxiv.org/html/2609.18278#S1.I1.i5.p1.1),[Figure 3](https://arxiv.org/html/2609.18278#S4.F3),[Figure 3](https://arxiv.org/html/2609.18278#S4.F3.4),[§4](https://arxiv.org/html/2609.18278#S4.p1.1),[§4](https://arxiv.org/html/2609.18278#S4.p2.1),[§4](https://arxiv.org/html/2609.18278#S4.p3.1)\.
- \[11\]Z\. Dong, P\. Wei, and L\. Lin\(2022\)Adversarially\-aware robust object detector\.InProceedings of the European Conference on Computer Vision \(ECCV\),Lecture Notes in Computer Science, Vol\.13669,pp\. 297–313\.External Links:[Document](https://dx.doi.org/10.1007/978-3-031-20077-9%5F18)Cited by:[§2\.2](https://arxiv.org/html/2609.18278#S2.SS2.p2.1)\.
- \[12\]T\. Fel, L\. Hervier, D\. Vigouroux, A\. Poche, J\. Plakoo, R\. Cadene, M\. Chalvidal, J\. Colin, T\. Boissin, L\. Bethune, A\. Picard, C\. Nicodeme, L\. Gardes, G\. Flandin, and T\. Serre\(2022\)Xplique: a deep learning explainability toolbox\.Workshop on Explainable Artificial Intelligence for Computer Vision \(CVPR\)\.External Links:[Document](https://dx.doi.org/10.48550/arXiv.2206.04394)Cited by:[§3\.2](https://arxiv.org/html/2609.18278#S3.SS2.p2.1)\.
- \[13\]I\. J\. Goodfellow, J\. Shlens, and C\. Szegedy\(2015\)Explaining and harnessing adversarial examples\.InICLR,External Links:[Document](https://dx.doi.org/10.48550/arXiv.1412.6572)Cited by:[§2\.1](https://arxiv.org/html/2609.18278#S2.SS1.p2.1),[§2\.2](https://arxiv.org/html/2609.18278#S2.SS2.p1.1)\.
- \[14\]J\. Guo, W\. Bao, J\. Wang, Y\. Ma, X\. Gao, G\. Xiao, A\. Liu, J\. Dong, X\. Liu, and W\. Wu\(2023\)A comprehensive evaluation framework for deep model robustness\.Pattern Recognition137,pp\. 109308\.External Links:ISSN 0031\-3203,[Document](https://dx.doi.org/10.1016/j.patcog.2023.109308),[Document](https://dx.doi.org/10.1016/j.patcog.2023.109308)Cited by:[§2\.2](https://arxiv.org/html/2609.18278#S2.SS2.p1.1)\.
- \[15\]M\. Hein and M\. Andriushchenko\(2017\)Formal guarantees on the robustness of a classifier against adversarial manipulation\.arXiv preprint\.External Links:[Document](https://dx.doi.org/10.48550/arXiv.1705.08475)Cited by:[§2\.2](https://arxiv.org/html/2609.18278#S2.SS2.p5.1)\.
- \[16\]International Organization for Standardization and International Electrotechnical CommissionInformation technology — Artificial intelligence — Artificial intelligence concepts and terminology\.StandardTechnical ReportISO/IEC 22989:2022,Geneva, Switzerland\.External Links:[Link](https://www.iso.org/standard/74296.html)Cited by:[3rd item](https://arxiv.org/html/2609.18278#S1.I1.i3.p1.1),[§1](https://arxiv.org/html/2609.18278#S1.p1.1),[§3\.1](https://arxiv.org/html/2609.18278#S3.SS1.p1.1)\.
- \[17\]\(2024\)ISO/IEC TR 5469:2024 \- Artificial intelligence — Functional safety and AI systems\.Technical ReportTechnical ReportISO/IEC TR 5469:2024,International Organization for Standardization \(ISO\) and International Electrotechnical Commission \(IEC\)\.External Links:[Link](https://www.iso.org/standard/81283.html)Cited by:[1st item](https://arxiv.org/html/2609.18278#S1.I1.i1.p1.1)\.
- \[18\]M\. Juliaet al\.\(2023\)It is all about data: a survey on the effects of data on adversarial robustness\.arXiv preprint\.External Links:[Document](https://dx.doi.org/10.48550/arXiv.2303.09767)Cited by:[Figure 1](https://arxiv.org/html/2609.18278#S2.F1),[Figure 1](https://arxiv.org/html/2609.18278#S2.F1.4)\.
- \[19\]G\. Katz, C\. Barrett, D\. L\. Dill, K\. Julian, and M\. J\. Kochenderfer\(2017\)Reluplex: an efficient smt solver for verifying deep neural networks\.InInternational conference on computer aided verification,pp\. 97–117\.External Links:[Document](https://dx.doi.org/https%3A//doi.org/10.48550/arXiv.1702.01135)Cited by:[§2\.2](https://arxiv.org/html/2609.18278#S2.SS2.p4.1)\.
- \[20\]P\. Klein\(1991\)The safety\-bag expert system in the electronic railway interlocking system elektra\.Expert Systems with Applications3\(4\)\.External Links:[Document](https://dx.doi.org/10.1016/0957-4174%2891%2990175-E)Cited by:[§3\.2](https://arxiv.org/html/2609.18278#S3.SS2.p4.1)\.
- \[21\]E\. H\. Lee, K\. Kim, S\. Kho, D\. Kim, and S\. Cho\(2021\)Estimating express train preference of urban railway passengers based on extreme gradient boosting \(xgboost\) using smart card data\.Transportation Research Record2675\(9\),pp\. 1–13\.External Links:[Document](https://dx.doi.org/10.1177/03611981211013349)Cited by:[2\(a\)](https://arxiv.org/html/2609.18278#S3.F2.sf1),[2\(a\)](https://arxiv.org/html/2609.18278#S3.F2.sf1.4),[§3\.1](https://arxiv.org/html/2609.18278#S3.SS1.p2.1)\.
- \[22\]B\. Li, P\. Qi, B\. Liu, S\. Di, J\. Liu, J\. Pei, J\. Yi, and B\. Zhou\(2023\)Trustworthy ai: from principles to practices\.ACM Computing Surveys55\(9\),pp\. Article 177\.External Links:[Document](https://dx.doi.org/10.1145/3555803)Cited by:[§1](https://arxiv.org/html/2609.18278#S1.p1.1)\.
- \[23\]F\. López, E\. D\. Santi, C\. Lefebvre, N\. Mijatovic, M\. Pugnaloni, V\. Martín, and K\. Saiah\(2025\)Track component failure detection using data analytics over existing stds track circuit data\.External Links:[Document](https://dx.doi.org/10.48550/arXiv.2508.11693)Cited by:[§1\.2](https://arxiv.org/html/2609.18278#S1.SS2.p3.1)\.
- \[24\]S\. M\. Lundberg, G\. G\. Erion, and S\. Lee\(2018\)Consistent individualized feature attribution for tree ensembles\.CoRRabs/1802\.03888\.External Links:[Document](https://dx.doi.org/10.48550/arXiv.1802.03888)Cited by:[§3\.1](https://arxiv.org/html/2609.18278#S3.SS1.p2.1)\.
- \[25\]A\. Madry, A\. Makelov, L\. Schmidt, D\. Tsipras, and A\. Vladu\(2017\)Towards deep learning models resistant to adversarial attacks\.arXiv preprint arXiv:1706\.06083\.External Links:[Document](https://dx.doi.org/10.48550/arXiv.1706.06083)Cited by:[§2\.2](https://arxiv.org/html/2609.18278#S2.SS2.p2.1)\.
- \[26\]D\. E\. Mathew, D\. U\. Ebem, A\. C\. Ikegwu, P\. E\. Ukeoma, and N\. F\. Dibiaezue\(2025\)Recent emerging techniques in explainable artificial intelligence to enhance the interpretable and understanding of ai models for human\.Neural Processing Letters57\(16\)\.External Links:[Document](https://dx.doi.org/10.1007/s11063-025-11732-2)Cited by:[§3\.2](https://arxiv.org/html/2609.18278#S3.SS2.p1.1)\.
- \[27\]J\. Mattioli, A\. Awadid, H\. Sohier, K\. Amokrane\-Ferka, F\. Adjed, and S\. Khalfaoui\(2024\)Trustworthy ML Assessment methodology\.In4th International Conference on AI ML, Data Science, and Robotics,External Links:[Link](https://hal.science/hal-04813492)Cited by:[§5](https://arxiv.org/html/2609.18278#S5.p1.1)\.
- \[28\]J\. Mattioli, H\. Sohier, A\. Delaborde, K\. Amokrane\-Ferka, A\. Awadid, Z\. Chihani, S\. Khalfaoui, and G\. Pedroza\(2024\)An overview of key trustworthiness attributes and kpis for trusted ml\-based systems engineering\.AI and Ethics4\.External Links:[Document](https://dx.doi.org/10.1007/s43681-023-00394-2)Cited by:[§5](https://arxiv.org/html/2609.18278#S5.p1.1)\.
- \[29\]D\. Minh, X\. Wang, F\. Li, and T\. N\. Nguyen\(2022\)Explainable artificial intelligence: a comprehensive review\.Artificial Intelligence Review55\(5\),pp\. 3503–3568\.External Links:[Document](https://dx.doi.org/10.1007/s10462-021-10088-y),[Link](https://link.springer.com/article/10.1007/s10462-021-10088-y)Cited by:[§3\.2](https://arxiv.org/html/2609.18278#S3.SS2.p1.1),[§3\.2](https://arxiv.org/html/2609.18278#S3.SS2.p2.1)\.
- \[30\]T\. Miyato, T\. Kataoka, M\. Koyama, and Y\. Yoshida\(2018\)Spectral normalization for generative adversarial networks\.arXiv preprint arXiv:1802\.05957\.External Links:[Document](https://dx.doi.org/https%3A//doi.org/10.48550/arXiv.1802.05957)Cited by:[§2\.2](https://arxiv.org/html/2609.18278#S2.SS2.p5.1)\.
- \[31\]C\. Molnar\(2020\)Interpretable machine learning: definitions, methods, and applications\.Lulu\.com\.External Links:[Link](https://christophm.github.io/interpretable-ml-book/)Cited by:[§3\.2](https://arxiv.org/html/2609.18278#S3.SS2.p1.1),[§3\.2](https://arxiv.org/html/2609.18278#S3.SS2.p3.1)\.
- \[32\]D\. Mukherjee, E\. Di Santi, C\. Lefebvre, N\. Mijatovic, V\. Martin, T\. Josse, J\. Brown, and K\. Saiah\(2025\)CVCM track circuits pre\-emptive failure diagnostics for predictive maintenance using deep networks\.arXiv preprint\.External Links:[Document](https://dx.doi.org/10.48550/arXiv.2508.09054)Cited by:[§1\.2](https://arxiv.org/html/2609.18278#S1.SS2.p3.1)\.
- \[33\]N\. Papernot, P\. McDaniel, and I\. Goodfellow\(2016\)Transferability in Machine Learning: from Phenomena to Black\-Box Attacks using Adversarial Samples\.arXiv\.External Links:[Document](https://dx.doi.org/10.48550/arXiv.1605.07277)Cited by:[§2\.2](https://arxiv.org/html/2609.18278#S2.SS2.p1.1)\.
- \[34\]K\. Quintero, L\. Mattioli, H\. Sohier, and J\. Mattioli\(2025\)An end\-to\-end method for operationalizing trustwothiness in AI\-based critical systems\.In15th International Conference on Performance, Safety and Robustness in Complex Systems and Applications PESARO 2025,External Links:[Link](https://hal.science/hal-05074120)Cited by:[§5](https://arxiv.org/html/2609.18278#S5.p1.1)\.
- \[35\]E\. D\. Santi, R\. Ci, C\. Lefebvre, N\. Mijatovic, M\. Pugnaloni, J\. Brown, V\. Martín, and K\. Saiah\(2025\)Scalable, technology\-agnostic diagnosis and predictive maintenance for point machine using deep learning\.External Links:[Document](https://dx.doi.org/10.48550/arXiv.2508.11692)Cited by:[§1\.2](https://arxiv.org/html/2609.18278#S1.SS2.p3.1)\.
- \[36\]R\. R\. Selvaraju, M\. Cogswell, A\. Das, R\. Vedantam, D\. Parikh, and D\. Batra\(2017\)Grad\-cam: visual explanations from deep networks via gradient\-based localization\.InProceedings of the IEEE International Conference on Computer Vision \(ICCV\),pp\. 618–626\.External Links:[Document](https://dx.doi.org/10.1109/ICCV.2017.74)Cited by:[§3\.1](https://arxiv.org/html/2609.18278#S3.SS1.p3.1)\.
- \[37\]M\. Serrurier, F\. Mamalet, A\. González\-Sanz, T\. Boissin, J\. Loubes, and E\. del Barrio\(2021\)Achieving robustness in classification using optimal transport with hinge regularization\.InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition \(CVPR\),External Links:[Document](https://dx.doi.org/10.1109/CVPR46437.2021.00057)Cited by:[§2\.2](https://arxiv.org/html/2609.18278#S2.SS2.p5.1)\.
- \[38\]L\. S\. Shapley\(1953\)A value for n\-person games\.Technical reportTechnical ReportP\-295,RAND Corporation\.External Links:[Link](https://www.rand.org/pubs/papers/P295.html)Cited by:[§3\.1](https://arxiv.org/html/2609.18278#S3.SS1.p2.1)\.
- \[39\]T\. Simonetto, M\. Cordy, S\. Ghamizi, Y\. L\. Traon, C\. Lefebvre, A\. Boystov, and A\. Goujon\(2025\)On the impact of industrial delays when mitigating distribution drifts: an empirical study on real\-world financial systems\.InDiscovering Drift Phenomena in Evolving Landscapes,Vol\.15013\.External Links:[Document](https://dx.doi.org/10.1007/978-3-031-82346-6%5F4)Cited by:[§4](https://arxiv.org/html/2609.18278#S4.p4.1)\.
- \[40\]J\. Sokolic, R\. Giryes, G\. Sapiro, and M\. R\. D\. Rodrigues\(2017\)Robust large margin deep neural networks\.IEEE Transactions on Signal Processing65\(16\),pp\. 4265–4280\.External Links:[Document](https://dx.doi.org/10.1109/TSP.2017.2708039)Cited by:[§2\.2](https://arxiv.org/html/2609.18278#S2.SS2.p5.1)\.
- \[41\]A\. Staino, A\. Suwalka, P\. Mitra, and B\. Basu\(2022\)Real\-time detection and recognition of railway traffic signals using deep learning\.Journal of Big Data Analytics in Transportation4\.External Links:[Document](https://dx.doi.org/10.1007/s42421-022-00054-7)Cited by:[§3\.1](https://arxiv.org/html/2609.18278#S3.SS1.p3.1)\.
- \[42\]S\. Stalder, N\. Perraudin, R\. Achanta, F\. Perez\-Cruz, and M\. Volpi\(2022\)What you see is what you classify: black box attributions\.InAdvances in Neural Information Processing Systems,Vol\.35,pp\. 84–94\.External Links:[Document](https://dx.doi.org/10.48550/arXiv.2205.11266)Cited by:[2\(b\)](https://arxiv.org/html/2609.18278#S3.F2.sf2),[2\(b\)](https://arxiv.org/html/2609.18278#S3.F2.sf2.4),[§3\.1](https://arxiv.org/html/2609.18278#S3.SS1.p3.1)\.
- \[43\]C\. Szegedy, W\. Zaremba, I\. Sutskever, J\. Bruna, D\. Erhan, I\. Goodfellow, and R\. Fergus\(2014\)Intriguing properties of neural networks\.InInternational Conference on Learning Representations \(ICLR\),External Links:[Document](https://dx.doi.org/10.48550/arXiv.1312.6199)Cited by:[§2\.1](https://arxiv.org/html/2609.18278#S2.SS1.p2.1),[§2\.2](https://arxiv.org/html/2609.18278#S2.SS2.p1.1)\.
- \[44\]\(2024\)The eu artificial intelligence act\.European Parliament and Council\.Note:[https://eur\-lex\.europa\.eu/eli/reg/2024/1689/oj](https://eur-lex.europa.eu/eli/reg/2024/1689/oj)Official Journal of the European Union, L series, 12\.7\.2024Cited by:[§1\.1](https://arxiv.org/html/2609.18278#S1.SS1.p1.1)\.
- \[45\]A\. Trilla, J\. Bob\-Manuel, B\. Lamoureux, and X\. Vilasis\-Cardona\(2021\)Integrated multiple\-defect detection and evaluation of rail wheel tread images using convolutional neural networks\.International Journal of Prognostics and Health Management12\(1\),pp\. 1–12\.External Links:[Document](https://dx.doi.org/10.36001/ijphm.2021.v12i1.2906)Cited by:[§3\.1](https://arxiv.org/html/2609.18278#S3.SS1.p3.1)\.
- \[46\]D\. Tsipras, S\. Santurkar, L\. Engstrom, A\. Turner, and A\. Madry\(2018\)There is no free lunch in adversarial robustness \(but there are unexpected benefits\)\.arXiv preprint arXiv:1805\.121522\(3\)\.External Links:[Link](https://arxiv.org/pdf/1805.12152v2)Cited by:[§2\.2](https://arxiv.org/html/2609.18278#S2.SS2.p5.1)\.
- \[47\]S\. Wang, H\. Zhang, K\. Xu, X\. Lin, S\. Jana, C\. Hsieh, and J\. Z\. Kolter\(2021\)Beta\-crown: efficient bound propagation with per\-neuron split constraints for neural network robustness verification\.Advances in neural information processing systems34,pp\. 29909–29921\.External Links:[Document](https://dx.doi.org/https%3A//doi.org/10.48550/arXiv.2103.06624)Cited by:[§2\.2](https://arxiv.org/html/2609.18278#S2.SS2.p4.1)\.
- \[48\]P\. Wigger\(2001\)Experience with safety integrity level \(sil\) allocation in railway applications\.InEIC2 Conference Proceedings,External Links:[Link](https://www.eic2.com/pdf/publ_2001_experience_with_safety_integrity_level_allocation_in_railway_applications.pdf)Cited by:[§1\.2](https://arxiv.org/html/2609.18278#S1.SS2.p2.1)\.
- \[49\]M\. Zeller, T\. Waschulzik, R\. Schmid, and C\. Bahlmann\(2023\)Towards a safe mlops process for the continuous development and safety assurance of ml\-based systems in the railway domain\.arXiv preprint\.External Links:[Document](https://dx.doi.org/10.48550/arXiv.2307.02867)Cited by:[§5](https://arxiv.org/html/2609.18278#S5.p3.1)\.