In HRI, trust is the human's belief that the robot will behave competently and safely in the next interaction. We model trust as a latent state that can be quantified and updated over time. Let \( \mathcal{H}_k \) denote the human's history of observations up to discrete interaction step \( k \). Define the trust level at time \( k \) as

\[ T_k \;=\; \mathbb{E}\!\left[ \mathbf{1}_{\{\text{robot succeeds at step }k\}} \,\middle|\, \mathcal{H}_k \right] \in [0,1]. \]

Thus \( T_k \) is the conditional probability (or expectation of a success indicator) that the robot will perform its task acceptably at step \( k \), given what the human has seen so far.

We distinguish:

• Objective reliability \( R \): the actual probability that the robot succeeds (e.g., does not violate safety constraints).
• Subjective trust \( T_k \): the human's internal estimate of this reliability.
• Transparency: how much of the robot's internal reasoning, state, and uncertainty is observable or inferable by the human.
• Explainability: the existence of a mapping from internal robot computations to human-understandable justifications.

Formally, let \( S_k \) be the robot state, \( A_k \) its action, and \( O_k \) the human's observation (including explanations, displays, etc.). We can define an explanation function

\[ E: \mathcal{S} \times \mathcal{A} \to \mathcal{M}, \]

mapping the state–action pair to a message \( M_k = E(S_k, A_k) \) in some space of human-readable messages \( \mathcal{M} \). Transparency and explainability are then analyzed in terms of how informative \( M_k \) is about the robot's true policy and uncertainties.

flowchart TD
  RSTATE["Robot state S_k"] --> ACT["Robot action A_k"]
  ACT --> WORLD["Environment outcome"]
  RSTATE --> EXPL["Explanation generator E(S_k, A_k)"]
  ACT --> EXPL
  EXPL --> MSG["Displayed message M_k"]
  WORLD --> OBS["Human observes outcome O_k"]
  MSG --> OBS
  OBS --> TRUST["Human updates trust T_{k+1}"]
        

Let \( C_k \in \{0,1\} \) be the event that the robot's decision at step \( k \) is correct or safe. Then \( T_k = P(C_k = 1 \mid \mathcal{H}_k) \). Suppose that at step \( k+1 \) the human observes a new signal \( O_{k+1} \), which may include the outcome (success or failure) and a visible explanation message \( M_{k+1} \). Using Bayes' rule, the updated trust is

\[ \begin{aligned} T_{k+1} &= P(C_{k+1}=1 \mid \mathcal{H}_k, O_{k+1}) \\ &= \frac{P(O_{k+1} \mid C_{k+1}=1, \mathcal{H}_k)\, P(C_{k+1}=1 \mid \mathcal{H}_k)} {\displaystyle \sum_{c \in \{0,1\}} P(O_{k+1} \mid C_{k+1}=c, \mathcal{H}_k)\, P(C_{k+1}=c \mid \mathcal{H}_k)}. \end{aligned} \]

In many models, one assumes a stationary reliability \( R = P(C_{k+1}=1) \) and likelihood functions \( P(O_{k+1} \mid C_{k+1}=c) \) that depend on whether the robot acted correctly. Explanations can change these likelihoods. For example, if a failure is accompanied by a clear, transparent explanation and a recovery plan, the human might treat it differently from a silent failure.

A simple numerical form is obtained by treating trust as a beta-distributed belief about \( R \). If \( R \sim \text{Beta}(\alpha_k, \beta_k) \), then one natural trust metric is

\[ T_k \;=\; \mathbb{E}[R \mid \alpha_k, \beta_k] \;=\; \frac{\alpha_k}{\alpha_k + \beta_k}. \]

After observing a correct step (\( C_{k+1}=1 \)) we update \( \alpha_{k+1} = \alpha_k + 1 \), \( \beta_{k+1} = \beta_k \); after a failure, \( \alpha_{k+1} = \alpha_k \), \( \beta_{k+1} = \beta_k + 1 \). Then

\[ T_{k+1} = \frac{\alpha_{k+1}}{\alpha_{k+1} + \beta_{k+1}} = \frac{\alpha_k + C_{k+1}}{\alpha_k + \beta_k + 1}. \]

This model is probabilistically grounded but can be cognitively heavy for real users. In HRI practice, it is common to approximate trust dynamics by simple linear recursions that behave like low-pass filters on success signals, as we discuss next.

A widely used phenomenological model treats trust as evolving according to a discrete-time linear system driven by observed successes and failures. Let \( s_k \in \{0,1\} \) indicate whether the robot's behavior at step \( k \) is perceived as successful (\( s_k = 1 \)) or not. Define

\[ T_{k+1} = (1-\lambda) T_k + \lambda s_k, \quad 0 < \lambda \leq 1, \]

where \( \lambda \) is a learning rate or trust update gain. This is exactly the exponential moving average used in control and signal processing.

3.1 Closed-form solution and forgetting property

We can unroll the recursion to express \( T_k \) in terms of the initial trust \( T_0 \) and all past successes.

\[ \begin{aligned} T_1 &= (1-\lambda) T_0 + \lambda s_0, \\ T_2 &= (1-\lambda) T_1 + \lambda s_1 = (1-\lambda)^2 T_0 + \lambda (1-\lambda) s_0 + \lambda s_1, \\ &\;\vdots \\ T_k &= (1-\lambda)^k T_0 + \lambda \sum_{j=0}^{k-1} (1-\lambda)^j s_{k-1-j}. \end{aligned} \]

Claim. The general formula

\[ T_k = (1-\lambda)^k T_0 + \lambda \sum_{j=0}^{k-1} (1-\lambda)^j s_{k-1-j} \]

holds for all \( k \geq 1 \).

Proof (by induction).

• For \( k=1 \), the formula matches the recursion.
• Assume it holds for some \( k \). Then \( T_{k+1} = (1-\lambda) T_k + \lambda s_k \) gives

\[ \begin{aligned} T_{k+1} &= (1-\lambda) \Big( (1-\lambda)^k T_0 + \lambda \sum_{j=0}^{k-1} (1-\lambda)^j s_{k-1-j} \Big) + \lambda s_k \\ &= (1-\lambda)^{k+1} T_0 + \lambda \sum_{j=0}^{k-1} (1-\lambda)^{j+1} s_{k-1-j} + \lambda s_k \\ &= (1-\lambda)^{k+1} T_0 + \lambda \sum_{j=1}^{k} (1-\lambda)^{j} s_{k-j} + \lambda s_k \\ &= (1-\lambda)^{k+1} T_0 + \lambda \sum_{j=0}^{k} (1-\lambda)^{j} s_{k-j}, \end{aligned} \]

which is the same form with \( k \) replaced by \( k+1 \). Hence the claim holds for all \( k \).

3.2 Convergence under constant performance

Suppose the robot's performance is stationary, so \( s_k = p \) for all \( k \), with \( 0 \leq p \leq 1 \). Then the recursion becomes

\[ T_{k+1} = (1-\lambda) T_k + \lambda p. \]

Consider the deviation \( e_k = T_k - p \). Then

\[ e_{k+1} = T_{k+1} - p = (1-\lambda) T_k + \lambda p - p = (1-\lambda)(T_k - p) = (1-\lambda) e_k. \]

Thus \( e_k = (1-\lambda)^k e_0 \). If \( 0 < \lambda \leq 1 \), then \( |1-\lambda| < 1 \), and \( e_k \to 0 \) as \( k \to \infty \). Therefore

\[ \lim_{k \to \infty} T_k = p. \]

This shows that the linear trust update converges to the robot's true average performance, while giving more weight to recent interactions. The parameter \( \lambda \) plays a similar role to a time constant \tau in linear control.

An explanation function \( E \) should trade off fidelity to the underlying robot policy and simplicity for the human. Let \( \pi \) denote the robot's (possibly complex) policy mapping states \( s \) to actions \( a \), and let \( \pi_E \) be a simplified explainer policy derived from \( E \). On a dataset \( \mathcal{D} = \{s_i\}_{i=1}^N \), define the fidelity loss

\[ L_{\text{fid}}(E) = \frac{1}{N} \sum_{i=1}^N \mathbf{1}_{\{\pi(s_i) \neq \pi_E(s_i)\}}, \]

and a simple complexity penalty such as the number of rules or parameters in the explanation model:

\[ C(E) = \text{number of free parameters in } \pi_E. \]

We may also include an uncertainty penalty \( U(E) \) measuring how often the explanation declares "I do not know" or omits important information.

A simple scalar score is

\[ J(E) = w_f \, L_{\text{fid}}(E) + w_c \, C(E) + w_u \, U(E), \quad w_f, w_c, w_u > 0. \]

Proposition. If explanations \( E_1 \) and \( E_2 \) satisfy

• \( L_{\text{fid}}(E_1) \leq L_{\text{fid}}(E_2) \),
• \( C(E_1) \leq C(E_2) \),
• \( U(E_1) \leq U(E_2) \),

with at least one inequality strict, then \( J(E_1) < J(E_2) \).

Proof.

Compute the difference:

\[ \begin{aligned} J(E_2) - J(E_1) &= w_f \big(L_{\text{fid}}(E_2) - L_{\text{fid}}(E_1)\big) + w_c \big(C(E_2) - C(E_1)\big) + w_u \big(U(E_2) - U(E_1)\big). \end{aligned} \]

Each term is nonnegative by assumption, and at least one is strictly positive. Because all weights are positive, \( J(E_2) - J(E_1) > 0 \), or equivalently \( J(E_1) < J(E_2) \). □

This formalizes a basic design principle: for fixed weights, an explanation that is never worse on fidelity, complexity, or uncertainty must be preferred. In practice, HRI experiments tune the weights \( w_f, w_c, w_u \) based on user studies.

From a control-engineering perspective, the human's trust can be modeled as an additional state in a closed-loop HRI system. Let the robot's physical state be \( x_k \), controlled by an input \( u_k \). Let \( T_k \) be the trust state. A simple coupled model is

\[ \begin{aligned} x_{k+1} &= A x_k + B u_k, \\ T_{k+1} &= (1-\lambda) T_k + \lambda s_k(x_k, u_k, O_k), \end{aligned} \]

where \( s_k \) encodes perceived success, which depends on the robot's behavior and explanations. A trust-aware controller can adapt autonomy level or explanation richness as a function of \( T_k \). For example,

\[ u_k = K(T_k)\,x_k, \]

where the gain \( K(T_k) \) may interpolate between teleoperation (low trust) and full autonomy (high trust).

flowchart TD
  HUMAN["Human"] --> CMD["High-level commands"]
  CMD --> ROBOT["Robot controller u_k"]
  ROBOT --> PLANT["Physical robot and environment x_k"]
  PLANT --> OUT["Observable behavior and outcomes"]
  OUT --> EXPL2["Generated explanations"]
  EXPL2 --> OBS2["Human perception (O_k)"]
  OBS2 --> TRUST2["Trust estimator T_k"]
  TRUST2 --> AUT["Autonomy / explanation level selector K(T_k)"]
  AUT --> ROBOT
        

Stability analysis of the augmented system typically assumes that the trust dynamics are slower than the physical dynamics, and that \( 0 < \lambda \ll 1 \). Under these conditions, standard linear control design for the physical subsystem can be combined with a separate analysis of the scalar trust subsystem.

We now implement the trust update \( T_{k+1} = (1-\lambda) T_k + \lambda s_k \) for a binary success sequence \( s_k \). In a real robot, each step \( s_k \) could be computed from safety monitors, constraint violations, or high-level task success flags.

6.1 Python implementation

def update_trust(successes, lam=0.2, T0=0.5):
    """
    successes: list of 0/1 values (perceived failures/successes)
    lam: trust update gain (0 < lam <= 1)
    T0: initial trust level
    """
    T = T0
    history = [T]
    for s in successes:
        T = (1.0 - lam) * T + lam * float(s)
        history.append(T)
    return history

if __name__ == "__main__":
    # Example: 1=success, 0=failure over 10 interactions
    seq = [1, 1, 0, 1, 1, 1, 0, 1, 1, 1]
    trust_traj = update_trust(seq, lam=0.3, T0=0.2)
    for k, T in enumerate(trust_traj):
        print(f"Step {k}: T = {T:.3f}")
      

6.2 C++ implementation

#include <iostream>
#include <vector>

std::vector<double> update_trust(const std::vector<int> &successes,
                                   double lambda, double T0) {
    double T = T0;
    std::vector<double> history;
    history.push_back(T);
    for (int s : successes) {
        T = (1.0 - lambda) * T + lambda * static_cast<double>(s);
        history.push_back(T);
    }
    return history;
}

int main() {
    std::vector<int> seq{1, 1, 0, 1, 1, 1, 0, 1, 1, 1};
    double lambda = 0.3;
    double T0 = 0.2;

    auto trust_traj = update_trust(seq, lambda, T0);
    for (std::size_t k = 0; k < trust_traj.size(); ++k) {
        std::cout << "Step " << k
                  << ": T = " << trust_traj[k] << '\n';
    }
    return 0;
}
      

6.3 Java implementation

public class TrustFilter {
    public static double[] updateTrust(int[] successes, double lambda, double T0) {
        double T = T0;
        double[] history = new double[successes.length + 1];
        history[0] = T;
        for (int k = 0; k < successes.length; ++k) {
            T = (1.0 - lambda) * T + lambda * (double) successes[k];
            history[k + 1] = T;
        }
        return history;
    }

    public static void main(String[] args) {
        int[] seq = {1, 1, 0, 1, 1, 1, 0, 1, 1, 1};
        double lambda = 0.3;
        double T0 = 0.2;
        double[] trustTraj = updateTrust(seq, lambda, T0);

        for (int k = 0; k < trustTraj.length; ++k) {
            System.out.printf("Step %d: T = %.3f%n", k, trustTraj[k]);
        }
    }
}
      

6.4 MATLAB and Simulink implementation

function trust_traj = update_trust(successes, lambda, T0)
% successes: row or column vector of 0/1
% lambda: scalar in (0,1]
% T0: initial trust

if nargin < 3
    T0 = 0.5;
end
if nargin < 2
    lambda = 0.2;
end

T = T0;
N = numel(successes);
trust_traj = zeros(N+1,1);
trust_traj(1) = T;

for k = 1:N
    s = double(successes(k));
    T = (1 - lambda) * T + lambda * s;
    trust_traj(k+1) = T;
end
end

% Example script:
% seq = [1 1 0 1 1 1 0 1 1 1];
% T = update_trust(seq, 0.3, 0.2);
% plot(0:numel(seq), T, '-o');
% xlabel('Step'); ylabel('Trust T_k'); grid on;
      

In Simulink, the same trust dynamics can be realized by:

• A Unit Delay block holding \( T_k \).
• A Gain block with gain \( 1-\lambda \) on the delayed trust, and another with gain \( \lambda \) on the success signal \( s_k \).
• A Sum block adding the two signals to produce \( T_{k+1} \).

This can be integrated into a larger HRI model where the success signal is generated from robot states, constraints, and human feedback.

In this lesson we modeled human trust in robots as both a probabilistic belief and a discrete-time state, showing how simple linear update rules relate to Bayesian reasoning and exponential forgetting. We used basic control-theoretic ideas to embed trust into the HRI feedback loop and defined quantitative metrics for transparency and explainability based on fidelity, complexity, and uncertainty. Finally, we implemented a trust filter in Python, C++, Java, and MATLAB—and outlined a Simulink realization—illustrating how trust-aware logic can be integrated into robot software stacks.