AI Advanced: AI Safety & Governance Practice Questions

Correct: This is a textbook indirect prompt injection — the attacker does not interact with the model directly; instead, they poison external content that the application retrieves and inserts into the prompt, causing the model to follow attacker-controlled instructions. Sanitizing and escaping retrieved documents (e.g., stripping HTML, removing instruction-like patterns, applying an input filter before context insertion) is the most direct mitigation at the retrieval/ingestion layer. | Calling this training data poisoning is incorrect: the attack occurs at inference time via the RAG pipeline, not during the model's training or fine-tuning phase. Training data poisoning requires the attacker to influence the dataset used to update model weights. | Disabling internet access would eliminate one retrieval source but is not the only viable mitigation and is often impractical; RAG systems can also pull from internal document stores that may be compromised. Sanitization is a more targeted and practical control. | A CSP on the client helps prevent rendered markdown from loading external resources in a browser, which is a valid defense-in-depth layer, but it does not address the injection vector itself — the model may still process and act on the instructions in other ways (e.g., API calls, tool use), making it insufficient as a standalone control. | A larger context window has no security properties; the model does not inherently deprioritize or 'dilute' injected instructions based on context length.

A model card is the industry-standard artifact for documenting a model's intended use cases, out-of-scope uses, training data characteristics, evaluation results, fairness considerations, and known limitations. It promotes transparency and responsible deployment. A threat model report documents security risks and attack surfaces, not model behavior. A system design document covers architectural decisions, not model-specific behavioral properties. An SBOM inventories software components and dependencies, not model characteristics.

The most robust approach combines NER (which catches contextually identified PII like names and addresses), regex patterns (which reliably catch structured PII like emails, SSNs, and phone numbers), and human review for edge cases that automated methods miss. Regex-only matching misses unstructured PII like names. NER alone without regex misses highly structured PII that lacks contextual signals. Hashing tokens destroys model utility without reliably targeting only PII. Encryption protects data at rest but does not remove PII from the dataset — the model would still train on PII.

Schema validation before deserialization ensures that only well-formed, expected JSON structures are processed, preventing malformed or injection-laden outputs from reaching the database. Parameterized database inserts prevent SQL injection by separating data from query logic, which is critical when LLM-extracted values are written to a database. Lower temperature increases formatting consistency but does not guarantee valid JSON or prevent injection payloads. Instructing the model in the system prompt to produce JSON is a best-effort measure that is not a security control—models can still deviate. Caching responses does not address structural or injection risks and would return stale data for repeated queries.

A DPA with SCCs is the legally recognized mechanism for transferring personal data outside the EEA under GDPR, ensuring the provider is contractually bound to GDPR-equivalent protections. Anonymizing or pseudonymizing personal data before sending it reduces or eliminates the GDPR obligation by removing or obscuring personal identifiers. Hosting the model in the EU is a valid alternative architecture but is not always feasible and was not listed as a primary ask. Client-side encryption does not fully address GDPR because the provider still processes the ciphertext and holds decryption keys in most API architectures. Opting out of model training prevents data from being used for future training but does not address the data transfer compliance requirement itself.