AI0-001 AI Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Data augmentation with synthetic X-ray images

  Why it's wrong here

  Data augmentation expands the training set with modified copies, which can improve generalization but does not provide any formal privacy protection. A stolen model could still contain information about original patients. Synthetic images may even introduce artifacts that leak information. This approach fails to deliver the quantifiable privacy guarantee needed.

• ✗

  Homomorphic encryption of the training data

  Why it's wrong here

  Homomorphic encryption allows computations on encrypted data, protecting data during processing, but it does not provide a privacy guarantee for the trained model itself. If the model is stolen, it may still leak information about the training data. The scenario requires protection even after model theft, which homomorphic encryption alone does not ensure.

• ✓

  Differential privacy with a calibrated noise mechanism

  Why this is correct

  Differential privacy adds calibrated noise to the training process, providing a mathematical guarantee that the inclusion or exclusion of any single patient's record has a bounded effect on the model's output. This makes it extremely difficult for an attacker with the stolen model to determine whether a specific patient was in the training set, directly addressing the requirement for a formal privacy guarantee.

• ✗

  Federated learning across hospital sites

  Why it's wrong here

  Federated learning keeps data local and shares only model updates, reducing data movement, but it does not inherently prevent a stolen model from leaking patient information. Without additional privacy mechanisms like differential privacy, the model can still memorize and expose sensitive details. Thus, it does not meet the requirement for a formal privacy guarantee.