RFI - Third-Party Testing and Validation of AI Products 4.18.24.pdf

Request for Information (RFI) U.S. Department of Agriculture

Office of the Chief Information Officer (OCIO) Enterprise Data Management Center (EDMC)

Third-Party Testing and Validation of Artificial Intelligence (AI) Products April 18, 2024

Please Note: This RFI is not a request for proposal (RFP). No solicitation is being issued at this time.

Anticipated place of performance is TBD.

1. Introduction

1.1 Purpose

Effectively leveraging Artificial Intelligence (AI) is critical for the U.S. Department of Agriculture (USDA) to achieve its ambitious goals outlined in the USDA Strategic Plan. This plan was developed to address climate change, increase nutrition security, ensure rural communities and economies thrive, increase opportunity for agricultural products at home and abroad, and ensure that USDA advances equity across all our programs and services. While the USDA is not new to AI, accelerating mission delivery with AI while protecting rights, safety and environmental and cultural equities requires a new approach. USDA is a highly federated organization where most resources are aligned to agency-led programs. Properly deploying enterprise AI requires a partnership between multiple stakeholders to effectively deliver.

The objective of this Request for Information (RFI) is to gather information on third-party services that specialize in testing and validating both generative and traditional AI models for USDA-wide applications.

1.2 Background

The Chief AI Officer – in partnership with the Chief Technology Officer, the Chief Information Security Officer and other USDA leaders – is working to develop “AI scaffolding” to support the adoption of AI across USDA. Through our AI scaffolding efforts, we will develop a safe and secure enterprise approach to developing and deploying AI in our various missions. Third-party testing and evaluation of AI models is a critical piece of that AI scaffolding, which provides justified confidence that systems enabled with AI at USDA continuously meet ethical and security requirements.

USDA has a public-facing inventory of AI, available on AI.gov.

2. Vendor Information and Qualifications

2.1 Company Overview and Capability Summary

• Please provide brief overview of the vendor's company, history, and experience in AI model testing.

• What are some examples of past projects or case studies?

• What are some of the tools used and testing methodologies employed for testing and validation of various types of AI models?

• Can you share the format and frequency of progress reports, preliminary findings, and final results?

• Do you provide post-testing support services, including addressing findings, optimization recommendations, and re-testing procedures?

3. Request for Information – Third Party Validation and Testing

Third party audits may include audits of security and compliance, performance and reliability, ethics and fairness, user and societal impact, and governance and continuous improvement.

3.1. Security and Compliance

This category focuses on the measures and protocols in place to protect against unauthorized access, data breaches, and ensure adherence to legal and regulatory standards.

• What areas do your third-party audits cover (e.g., security, data privacy, robustness, dependencies and compliance)?

• How does the audit ensure compliance with relevant regulations, standards, and frameworks (e.g., DPR, CCPA, NIST AI RMF, GAO AI Accountability Framework, OMB AI guidance, etc.)?

• How are third-party dependencies and integrations evaluated for security and compliance?

• How does the audit review the tool's data handling, data privacy, security, and storage practices?

• How are changes in the tool or its use cases reviewed in subsequent audits?

• Does the tool have any certifications or accreditations resulting from these audits?

• How does the audit review the process for responding to security incidents (data breaches, model tampering, and/or service interruptions, etc.) affecting the AI tool? How does the audit evaluate the tool's resilience against external threats and attacks?

• How does the audit review the AI model’s output when the model under an adversarial attack. In the case of generative AI, this could include malicious altering of text input?

3.2. Performance and Reliability

This category assesses how the AI tool functions under various conditions and its capacity to perform tasks effectively and consistently.

• How is the tool's performance and reliability assessed during audits?

• How is the tool's interoperability with other systems and software assessed?

• Does the audit assess the tool's scalability and its performance under different loads?

• How adaptable is the tool to changes in regulatory requirements as assessed by the audit?

3.3. Ethics and Fairness

Questions in this category examine how the AI tool addresses ethical concerns, ensures fairness, and mitigates biases in its operations.

• How are ethical considerations and fairness evaluated in the audits?

• How does the audit address and evaluate the tool's transparency and explainability?

• How are potential biases detected and mitigated according to the audit?

• How are risks assessed and prioritized in the audit, especially those related to AI ethics and misuse?

• How is data privacy (data anonymization and data security) evaluated in the audits?

3.4. User and Societal Impact

This category delves into how the AI tool affects its users and society at large, including aspects of accessibility, protecting rights, cultural appropriateness, and environmental impact.

• Are stakeholders (e.g., users, affected parties) typically involved or consulted during the audit process?

• How is user feedback incorporated into the audit to assess the tool's impact and effectiveness?

• What training and support measures are evaluated for users of the AI tool?

• How does the audit address accessibility for users with disabilities?

• How does the audit assess the tool's appropriateness across different cultural and linguistic contexts?

• Does the audit include an impact assessment to evaluate social, economic and/or environmental impact of the AI model? Are unintended consequences accounted for?

3.5. Governance and Continuous Improvement

Questions in this category focus on the governance around the AI tool's use, how feedback is incorporated, and the mechanisms for continuous improvement and adaptation over time.

• How frequently are these third-party audits normally conducted?

• Who conducts the audits, and what credentials or qualifications do they have?

• What methodologies are used in the audits to assess the AI tool's various aspects?

• How does the audit process itself incorporate feedback for continuous improvement?

• How adaptable is the tool to changes in regulatory requirements as assessed by the audit?

• Does the audit include a review of documentation related to the development of the AI tool?

• Does the audit evaluate the process for identifying, reporting and responding to any incidents (data breaches, ethical breaches, or performance failures, etc.) from the AI model?

4. Submission Guidelines

4.1 Response Format

Written responses should not exceed ten pages, plus a one-page cover page, as described below.

Please respond concisely, in plain language, and specify which question(s) you are responding

to. You may also include links to online materials or interactive presentations, but please ensure all links are publicly available. Each response should include:

• The name of the individual(s) and/or organization responding.

• A brief description of the responding individual(s) or organization's mission and/or areas of expertise.

• The section(s) that your submission and materials are related to.

• A contact for questions or other follow-up on your response.

• Size and business classification (ex: 8a, HUBZone, SDVOSB, WOSB, etc.).

By responding to the RFI, each participant (individual, team, or legal entity) warrants that they are the sole author or owner of, or has the right to use, any copyrightable works that the submission comprises, that the works are wholly original (or is an improved version of an existing work that the participant has sufficient rights to use and improve), and that the submission does not infringe any copyright or any other rights of any third party of which participant is aware.

By responding to the RFI, each participant (individual, team, or legal entity) consents to the contents of their submission being made available to all Federal agencies and their employees on an internal-to-government website accessible only to agency staff persons.

Participants will not be required to transfer their intellectual property rights to the USDA, but participants must grant to the Federal Government a nonexclusive license to apply, share, and use the materials that are included in the submission. To participate in the RFI, each participant must warrant that there are no legal obstacles to providing the above-referenced nonexclusive licenses of participant rights to the Federal Government. Interested parties who respond to this RFI may be contacted for follow-on questions or discussion.

4.2 Deadline

Submissions are due by 5pm MT on May 3, 2024. All responses shall be sent via email to the Contracting Officer at Shannon.Robbie@usda.gov

Please Note: The intent is to have a third-party, separate from those developing the AI applications, to test and validate.

mailto:Shannon.Robbie@usda.gov