# Failure Modes in Machine Learning Systems

arXiv: https://arxiv.org/abs/1911.11034 · HTML: https://mlsanity.com/paper/1911.11034/

## Key facts

- Cited by 15 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 25 Nov 2019.

## Built on by (most cited first, 15 of 15)

- [On managing vulnerabilities in AI/ML systems](https://mlsanity.com/paper/2101.10865/) (2021)
- [Privacy Measurement in Tabular Synthetic Data: State of the Art and Future Research Directions](https://mlsanity.com/paper/2311.17453/) (2023)
- [The Duo of Artificial Intelligence and Big Data for Industry 4.0: Review of Applications, Techniques, Challenges, and Future Research Directions](https://mlsanity.com/paper/2104.02425/) (2021)
- [The SkipSponge Attack: Sponge Weight Poisoning of Deep Neural Networks](https://mlsanity.com/paper/2402.06357/) (2024)
- [Multi-Fault Diagnosis Of Industrial Rotating Machines Using Data-Driven Approach: A Review Of Two Decades Of Research](https://mlsanity.com/paper/2206.14153/) (2022)
- [Emerging AI Security Threats for Autonomous Cars -- Case Studies](https://mlsanity.com/paper/2109.04865/) (2021)
- [MLSmellHound: A Context-Aware Code Analysis Tool](https://mlsanity.com/paper/2205.03790/) (2022)
- [A reading survey on adversarial machine learning: Adversarial attacks and their understanding](https://mlsanity.com/paper/2308.03363/) (2023)
- [Technology Readiness Levels for Machine Learning Systems](https://mlsanity.com/paper/2101.03989/) (2021)
- [Robust optimization for adversarial learning with finite sample complexity guarantees](https://mlsanity.com/paper/2403.15207/) (2024)
- [Protecting Feed-Forward Networks from Adversarial Attacks Using Predictive Coding](https://mlsanity.com/paper/2411.00222/) (2024)
- [Revealing Interpretable Failure Modes of VLMs](https://mlsanity.com/paper/2605.12674/) (2026)
- [AI Assurance in UK Defence: Challenges in Operationalising JSP 936](https://mlsanity.com/paper/2606.09414/) (2026)
- [Robustness Cannot be Reduced to Regularization: Studying Adversarial Training Beyond the Linear Case](https://mlsanity.com/paper/2606.21488/) (2026)
- [From Failure to Alignment: A Requirements Engineering Framework for Machine Learning Systems](https://mlsanity.com/paper/2606.31589/) (2026)

## Abstract (arXiv)

In the last two years, more than 200 papers have been written on how machine learning (ML) systems can fail because of adversarial attacks on the algorithms and data; this number balloons if we were to incorporate papers covering non-adversarial failure modes. The spate of papers has made it difficult for ML practitioners, let alone engineers, lawyers, and policymakers, to keep up with the attacks against and defenses of ML systems. However, as these systems become more pervasive, the need to understand how they fail, whether by the hand of an adversary or due to the inherent design of a system, will only become more pressing. In order to equip software developers, security incident responders, lawyers, and policy makers with a common vernacular to talk about this problem, we developed a framework to classify failures into "Intentional failures" where the failure is caused by an active adversary attempting to subvert the system to attain her goals; and "Unintentional failures" where the failure is because an ML system produces an inherently unsafe outcome. After developing the initial version of the taxonomy last year, we worked with security and ML teams across Microsoft, 23 external partners, standards organization, and governments to understand how stakeholders would use our framework. Throughout the paper, we attempt to highlight how machine learning failure modes are meaningfully different from traditional software failures from a technology and policy perspective.