AI Security, Ethics and Governance practice questions

Implement role-based access control (RBAC) on the AI model's inference API.

Why wrong: RBAC controls who can access the model, but it does not prevent the model from returning data from opt-out patients.

Use differential privacy during model training.

Why wrong: Differential privacy reduces memorization but does not guarantee complete removal of specific patient data from model outputs.

Encrypt the training data at rest and in transit.

Why wrong: Encryption protects data from unauthorized access but does not prevent the model from memorizing and outputting sensitive data.

Increase the diversity of the training data by collecting more samples from underrepresented groups.

Why wrong: While diversity is important, simply adding data without analysis may not resolve bias and could introduce new issues.

Retrain the model every month with the latest transaction data.

Why wrong: Retraining may not address bias; it could even perpetuate existing biases if new data is similarly biased.

Use SHAP values to provide explanations for each prediction.

Why wrong: Explainability helps understand model decisions but does not directly identify or correct bias.

Train the model with a loss function that weights profit more heavily than customer satisfaction.

Why wrong: This would exacerbate the problem by further prioritizing profit.

Adjust the model's hyperparameters to reduce the influence of profit features.

Why wrong: Hyperparameter tuning might help but does not systematically balance multiple objectives.

Remove profit data from the training set and only use customer preference data.

Why wrong: This may ignore business needs and reduce profitability significantly.

Use a random selection of candidates to avoid bias.

Why wrong: Random selection would eliminate bias but also eliminate the model's ability to predict job performance.

Remove the gender feature from the dataset and retrain.

Why wrong: Removing gender may not eliminate bias if other features (e.g., years of experience correlated with gender) still act as proxies.

Collect more training data from underrepresented groups.

Why wrong: More data may not address the bias if the collection process itself is biased.

Use explainable AI techniques to understand why the chatbot generates certain responses.

Why wrong: Explainability helps understand behavior but does not prevent the chatbot from generating harmful outputs.

Encrypt all chatbot conversations at rest and in transit.

Why wrong: Encryption protects data from unauthorized access but does not prevent the chatbot from generating privacy-violating responses.

Anonymize the training data used to train the chatbot.

Why wrong: Anonymization reduces but does not eliminate the risk of the chatbot generating responses that contain personal information.

Replace the convolutional layers with transformer layers to improve attention.

Why wrong: Changing architecture typically requires full retraining and may not address low-light specifically.

Use adversarial training to add imperceptible perturbations to training images.

Why wrong: Adversarial training improves resistance to malicious perturbations but not necessarily to natural low-light conditions.

Increase the model's depth by adding more convolutional layers.

Why wrong: Increasing depth changes architecture and requires retraining; it may not directly address low-light performance.

Privacy by design

Why wrong: Privacy by design focuses on data protection, not on ensuring fair pricing outcomes.

Accountability

Why wrong: Accountability assigns responsibility but does not directly address the fairness of the pricing algorithm.

Beneficence

Why wrong: Beneficence focuses on promoting good, but does not specifically prevent unfair pricing practices.

Model pruning to reduce the number of parameters.

Why wrong: Pruning can remove neurons that are critical for detecting adversarial perturbations, reducing robustness.

Increasing model complexity to capture more patterns.

Why wrong: Increased complexity can make the model more sensitive to small perturbations, making attacks easier.

Hyperparameter optimization using grid search.

Why wrong: Hyperparameter optimization does not directly defend against adversarial attacks.

Cloud-based deployment for scalability.

Why wrong: Deployment method is operational, not governance.

Model accuracy thresholds for production deployment.

Why wrong: Accuracy is a performance metric, not a governance component.

Normalizing features to zero mean and unit variance.

Why wrong: Normalization does not identify malicious data; it only transforms values.

Using ensemble methods like random forest for training.

Why wrong: Ensembles improve robustness but are not a detection technique.

Applying PCA to reduce dimensionality.

Why wrong: PCA can obscure patterns of poisoning rather than reveal them.

Enable detailed audit logging

Why wrong: Audit logs help detect breaches but do not prevent them or protect privacy.

Encrypt all data at rest and in transit

Why wrong: Encryption protects confidentiality but does not anonymize the data; re-identification is still possible.

Implement role-based access control

Why wrong: Access control limits who can see data but does not protect against misuse by authorized users.

Retrain the model using a balanced dataset

Why wrong: Balancing data improves representation but does not eliminate bias from feature interactions.

Remove all protected attributes from the training data

Why wrong: Bias can persist through correlated features, so removal alone is insufficient.

Post-process model outputs to adjust for demographic parity

Why wrong: Post-processing can hurt performance and may not address root cause.

Set up a human-in-the-loop review process

Why wrong: Human review is slower and costlier; automated filtering is first line.

Create a usage policy for acceptable bot behavior

Why wrong: Policies guide development but are not a technical control.

Sanitize training data to remove toxic examples

Why wrong: Training data sanitization reduces risk but does not guarantee safe outputs in all cases.

Conduct additional testing to measure the disparity

Why wrong: Testing identifies the issue but does not fix it.

Replace the object detection algorithm with a different one

Why wrong: Algorithm change may not address data imbalance.

Adjust the model's decision threshold for pedestrian detection

Why wrong: Threshold adjustment changes sensitivity but does not improve feature learning.

Encrypting the model weights

Why wrong: Encryption protects the model at rest, not during inference.

Continuous model monitoring

Why wrong: Monitoring detects attacks but does not prevent them.

Rate limiting API access

Why wrong: Rate limiting reduces abuse but does not defend against crafted inputs.

The server ran out of memory due to high traffic

Why wrong: Only one request is logged; no high traffic indication.

The model weights were corrupted during loading

Why wrong: No error indicates model loading issue; the crash happened during inference.

The model encountered an unknown data type

Why wrong: The input is text; unknown data type would cause a parsing error, not memory allocation.

Increase the number of model replicas to distribute the load

Why wrong: More replicas do not prevent attacks; they spread the impact.

Retrain the model with adversarial examples

Why wrong: Retraining requires time and data, not suitable for real-time mitigation.

Roll back the model to a previous version that was not attacked

Why wrong: Rollback does not prevent the same attack on the previous version if it is also vulnerable.

Ignore the requirement as the model is proprietary

Why wrong: Regulatory compliance is mandatory; ignoring is not an option.

Ask the vendor to develop a custom explanation module

Why wrong: Vendor already indicated impossibility; custom module may not be feasible.

Replace the model with a simpler, interpretable model

Why wrong: Simpler models may have lower performance, impacting business.

Data poisoning

Why wrong: Poisoning affects model training, not inference confidence patterns.

Evasion attack

Why wrong: Evasion causes misclassification, not overconfidence on specific individuals.

Model extraction attack

Why wrong: Extraction aims to steal model parameters, not produce confidence anomalies.

Transparency

Why wrong: Transparency involves openness about model decisions, not addressing disparate impact.

Privacy

Why wrong: Privacy focuses on data protection, not group-level discrimination.

Accountability

Why wrong: Accountability is about assigning responsibility, not preventing bias itself.