AI Auditing Tools And Techniques practice questions

Total inference latency measured at the API gateway

Why it fails: Latency reflects infrastructure and serving performance, not whether the mapping from inputs to labels has changed. A model can serve quickly while silently degrading in accuracy, so latency monitoring, however useful operationally, does not indicate concept drift and should not be relied on for that purpose.

Count of active user accounts authorized to call the prediction endpoint

Why it fails: The number of authorized accounts is an access-control and provisioning metric. It says nothing about whether the model's decision behaviour still matches the environment it was trained on, so it cannot serve as evidence of concept drift and is unrelated to the monitoring objective under audit.

Number of pull requests merged into the model-serving repository each sprint

Why it fails: Pull request counts measure development activity, not changes in the statistical relationship the deployed model relies on. A quiet sprint does not mean the model is stable, and a busy one does not mean it has drifted, so this activity metric gives the auditor no evidence about concept drift in production.

SageMaker Model Monitor

Why it fails: Model Monitor detects data and model drift on deployed endpoints; it does not compute pre-training or post-training bias metrics. It is tempting because it is the SageMaker monitoring service, and would be correct for alerting on feature distribution shifts or quality degradation in production inference traffic.

AWS Glue DataBrew

Why it fails: Glue DataBrew profiles and transforms datasets for preparation; it produces no pre-training or post-training bias metric report. It is tempting because bias work begins with data inspection, and DataBrew would be correct for cleaning, normalising, or detecting anomalies in the raw training dataset before model development.

Amazon Inspector

Why it fails: Inspector scans compute workloads and repositories for software vulnerabilities and unintended network exposure, not statistical bias in models. It is tempting because it is a security assessment service within AWS, and would be correct for identifying CVEs or configuration weaknesses in the infrastructure hosting the SageMaker endpoint.

Causal Inference component

Why it fails: Causal Inference is for determining cause-effect relationships.

Model Overview component

Why it fails: Model Overview summarises performance metrics and dataset statistics, offering no counterfactual generation. Counterfactual analysis lives in the Responsible AI dashboard's Error Analysis or counterfactual component, which perturbs features to show minimal changes flipping a prediction. Model Overview is for aggregate metric review.

Error Analysis component

Why it fails: Error Analysis clusters misclassified cohorts and surfaces error trees; it does not generate counterfactuals. It tempts because both sit in the Responsible AI dashboard and both diagnose model behaviour, but counterfactual analysis belongs to the What-If Counterfactuals component, which perturbs features to show prediction changes.

Quality monitor

Why it fails: The Quality monitor tracks accuracy, precision and drift against labelled feedback data, not outcome parity across protected groups. It is tempting because it is the natural choice for detecting model degradation and performance decay over time, yet Disparate Impact requires the Fairness monitor, which computes metrics such as disparate impact ratio from payload and fairness attribute records.

Drift detection monitor

Why it fails: Drift detection monitors changes in model input data or accuracy over time, not fairness across protected groups. It is the correct monitor when you need to detect data or model drift, but Disparate Impact requires a fairness monitor instead.

Explainability monitor

Why it fails: Explainability monitors generate feature-attribution explanations for individual predictions, not statistical fairness metrics across groups. Explainability is the right choice when regulators need to understand why a specific decision was made, not to detect Disparate Impact.

Payload logging

Why it fails: Payload logging captures request and response data for drift and explainability, not fairness metrics. Disparate impact requires configuring a fairness monitor with a protected attribute and favourable outcome, which computes the disparate impact ratio. Payload logging is tempting because it feeds monitors, but it detects nothing on its own.

Vertex AI Feature Store

Why it fails: Feature Store manages feature definitions and serving for training and prediction; it holds no artifact lineage graph. Auditors needing provenance inspect Vertex AI Metadata Store, which records executions, artifacts and their relationships. Feature Store would be the choice for reusing engineered features across models.

Cloud Logging

Why it fails: Cloud Logging captures API calls and service activity, not the artefact relationship graph. Provenance queries need Vertex AI Metadata Store, which stores contexts, executions and lineage links. Cloud Logging would be correct for auditing who invoked a service or troubleshooting runtime errors.

Vertex AI Model Registry

Why it fails: Model Registry stores and versions trained models; it does not expose the lineage graph of datasets, training jobs and artefacts. It is tempting because it is the natural place to inspect a model, but Vertex AI Metadata Store is the service that records provenance relationships for audit.

Model pruning

Why it fails: Model pruning removes weights or neurons to shrink a network, so it does not perturb inputs or reveal output sensitivity. It is tempting because pruning is a legitimate robustness technique, but it targets model size and inference cost; input perturbation for adversarial testing is instead performed by fuzzing or adversarial example generation.

Bias assessment

Why it fails: Bias assessment measures disparate outcomes across demographic groups, not sensitivity to perturbed inputs. It is tempting because both fall under AI auditing, but bias testing compares prediction rates between subgroups; adversarial robustness testing deliberately mutates input features and observes whether the model's output changes materially.

Data augmentation

Why it fails: Data augmentation expands training data with transformed copies to improve generalisation, so it does not test whether perturbed inputs change outputs. It is tempting because it also manipulates input data, but augmentation happens before training to reduce overfitting; adversarial robustness testing perturbs inputs at inference time to probe the trained model.

Latency testing

Why it fails: Latency measures inference response time, which reflects infrastructure load and model size, not the integrity of training labels or weights. Poisoned data can leave latency unchanged. Latency testing belongs in performance regression suites, where it detects serving degradation rather than data tampering.

Model Accuracy testing

Why it fails: Accuracy on a held-out set can stay high if poisoned samples are few or target specific inputs, so aggregate accuracy hides backdoors. Poisoning verification needs data-provenance and outlier inspection. Accuracy testing is for generalisation checks after retraining, not for detecting deliberately corrupted training data.

Hyperparameter tuning

Why it fails: Hyperparameter tuning searches learning rates and depth to optimise metrics; it neither inspects training records nor detects injected samples. A poisoned dataset tunes just as smoothly. Tuning is the right task when maximising validation performance, not when auditing whether training data was manipulated.

MLflow Model Registry

Why it fails: The Model Registry tracks model versions, stages and deployment lineage, not the parameters or code commit of a training run. It is tempting because it stores versioning metadata, and it would be the right object when auditing which model version was promoted to production.

MLflow Experiment

Why it fails: An MLflow Experiment groups runs under a named container; it stores no parameter values or source-code identifiers itself. It is tempting because runs are listed beneath it, but the Run object is what records params, metrics, tags and the source version needed for audit verification.

MLflow Tracking Server

Why it fails: The Tracking Server is the backend service that receives and stores logged data; it holds no per-run parameter or code-version record an auditor can read. It is tempting because all logging passes through it, but the Run object is the artefact that actually captures params and source version.

Detecting data drift

Why it fails: SHAP values explain how individual features contributed to a specific prediction, so the auditor's objective is local or global feature attribution and model interpretability. Detecting data drift compares input distributions over time using statistical monitoring, which SHAP does not measure.

Security vulnerability scanning

Why it fails: Security vulnerability scanning targets software and infrastructure flaws, not the interpretability of SHAP attributions. It is tempting because audits often include security, but the primary objective here is validating that SHAP values faithfully explain model predictions and are not misleading.

Infrastructure scaling

Why it fails: Infrastructure scaling concerns compute capacity, not model interpretability, so it cannot address the audit's need to explain SHAP feature attributions. It is tempting because scaling is a legitimate audit concern for deployed endpoints, and would be the correct focus when assessing whether inference throughput or cost meets operational requirements.

Data encryption

Why it fails: Data encryption protects stored or in-transit data; it does not identify or correlate a logged prediction. It is tempting because encryption keys and certificates carry identifiers, but such an identifier would be the correct choice when auditing cryptographic operations, not when tracing a single inference request through the log.

Hyperparameter storage

Why it fails: Hyperparameters are configured before training and stored in experiment-tracking systems, not attached to individual inference requests. It is tempting because hyperparameter records do carry identifiers, but that identifier would be the correct choice when linking training runs to their configuration, not when tracing a logged prediction.

Model compression

Why it fails: Model compression is a training or deployment optimisation that shrinks model size; it has no relationship to correlating log entries for a single prediction. It is tempting because compression IDs may appear in some pipelines, but it would be relevant only when logging artefact-reduction metadata, not inference tracing.

To encrypt model weights in memory

Why it fails: Shadow Mode concerns traffic duplication and output comparison, not protecting model weights at rest or in memory; that is handled by encryption mechanisms such as KMS-backed volume encryption or Nitro Enclaves. Shadow Mode would be correct when you need to observe a new model's live predictions without exposing users to them.

To hide model artifacts from unauthorized users

Why it fails: Shadow Mode runs a candidate model alongside production to compare predictions without serving users; it does not restrict access to artifacts, which is handled by access controls and registries. It is tempting because shadow deployments are often kept private, and it would be correct if the question concerned concealing model files from unauthorised users.

To automate hyperparameter optimization

Why it fails: Shadow Mode mirrors live production traffic to a candidate model without serving its predictions, so hyperparameter tuning is unrelated; that belongs to training-time optimisation frameworks such as SageMaker Automatic Model Tuning. Shadow Mode would be the right choice when validating a challenger model's outputs against the incumbent before any cutover.

Kubelet

Why it fails: Kubelet runs containers on each node and reports pod status; it holds no record of pipeline step definitions, inputs or artefacts. Reproducibility requires the pipeline specification and metadata. Kubelet is examined when diagnosing pod scheduling or container runtime faults, not pipeline provenance.

Prometheus

Why it fails: Prometheus scrapes time-series metrics for monitoring and alerting on cluster health, not pipeline provenance. Reproducibility requires Kubeflow Pipelines' recorded container images, parameters and artefacts. Prometheus would be the right choice for detecting resource saturation or latency regressions during training runs.

Istio

Why it fails: Istio is a service mesh handling traffic routing, mTLS and observability, not pipeline step definition or artefact versioning. It tempts because it sits in the Kubernetes stack and aids deployment consistency, and would be examined for network policy enforcement, but reproducibility lives in the pipeline specification and container images.

Server Hardware Specs

Why it fails: Hardware specifications describe compute, memory and accelerators, revealing nothing about the system's purpose or boundaries. They belong in an infrastructure or capacity review, and would be the right document when auditing resource adequacy or deployment environment.

Financial Statement

Why it fails: Financial statements report monetary performance and position, not the purpose for which an AI system was designed. They are the correct evidence in a financial or cost audit, not in establishing intended use, which requires design and scope documentation.

Employee Training Log

Why it fails: Training logs evidence who was taught what, not what the system was built to do. They are audit evidence for competency and awareness controls, so they would be the correct artefact when assessing human oversight or staff readiness, not intended use.

Sentiment analysis

Why it fails: Sentiment analysis scores emotional tone of text and cannot detect adversarial instructions embedded in prompts. It tempts because it is a common NLP evaluation technique, and would be correct for gauging user feedback tone, not for probing whether injected directives override system prompts.

Cross-validation

Why it fails: Cross-validation partitions labelled data to estimate generalisation error; it has no mechanism for adversarial prompt payloads. It tempts as a standard model-quality technique, and would be right for tuning hyperparameters or detecting overfitting, not for testing resistance to prompt injection attacks.

Tokenization audit

Why it fails: Tokenization audits examine how text is split into tokens, which reveals nothing about whether injected instructions override system prompts. Robustness testing requires adversarial prompt payloads and observation of model behaviour. Tokenization analysis would be correct when investigating context-window limits or token-cost accounting.

Encrypt the dataset

Why it fails: Encryption protects data at rest but leaves values usable for group metric computation, so it does not prepare the dataset for Aequitas; the tool needs protected attributes present and labelled. Encryption is correct for securing stored sensitive data, not for fairness auditing.

Train a new model

Why it fails: Aequitas audits an existing model's predictions; it does not build models, so training one supplies no bias metrics. Training is the tempting step because fairness work often begins after model development, but here the toolkit expects a dataset and prediction labels already in hand.

Delete sensitive attributes

Why it fails: Deleting sensitive attributes removes the protected characteristics Aequitas needs to compute group fairness metrics, so no disparate-impact analysis is possible. It is tempting because attribute suppression is a recognised privacy technique for minimising data collection, and would be the right choice when preparing a dataset for release rather than auditing it.

Change in model parameters

Why it fails: PSI compares the distribution of a feature's values between a reference sample and a current sample; it never inspects weights or coefficients. Model parameter change is detected by retraining comparisons or weight-drift monitoring, which is the correct tool when tracking how a model's learned parameters shift over time.

Change in model accuracy

Why it fails: PSI measures input feature distribution shift, not predictive performance; accuracy change requires labelled outcomes. Model accuracy change is detected by performance monitoring against ground truth, which is the correct approach when labels are available and you need to track degradation in predictions.

Increase in inference latency

Why it fails: PSI is computed from binned feature-value proportions, so it cannot observe serving latency. Inference latency increase is an operational metric tracked by APM or performance monitoring, which is the right choice when diagnosing slow predictions rather than input distribution shift.

Memory leaks in model deployment

Why it fails: CleverHans detects adversarial examples — inputs perturbed to cause misclassification — not memory leaks, which are found through fuzzing or static analysis of deployment code. It is tempting because both concern model robustness, but CleverHans specifically implements attacks and defences against evasion.

Infrastructure misconfiguration

Why it fails: CleverHans detects adversarial examples — crafted inputs causing misclassification — not infrastructure misconfiguration, which configuration scanners or cloud posture tools address. It is tempting because both fall under AI assurance, but CleverHans operates at the model level, generating and defending against evasion attacks.

PII leaks in training data

Why it fails: CleverHans detects adversarial examples that fool model predictions, not PII leakage in training data, which requires membership-inference or extraction testing. It is tempting because both are AI security concerns, but CleverHans focuses on evasion robustness rather than privacy exposure.

Logarithmic growth

Why it fails: Logarithmic growth describes a mathematical curve, not a classification audit metric. Auditing classification models uses precision, recall, F1, AUC-ROC or confusion-matrix-derived measures. It is tempting only as a distractor resembling loss-curve terminology, but it measures nothing about predicted class labels.

Mean Squared Error

Why it fails: Mean Squared Error measures the average squared difference between predicted and actual continuous values, making it a regression metric. Classification auditing requires precision, recall, F1 or AUC-ROC computed from discrete labels. MSE is tempting because it is a standard model metric, but it ignores class membership entirely.

CPU utilization

Why it fails: CPU utilization measures compute load, not classification quality, so it cannot reveal accuracy, precision, recall or confusion-matrix behaviour on labelled data. It is tempting because it is a standard infrastructure metric for capacity planning and autoscaling, and would be the right choice when auditing resource consumption or sizing the inference fleet.

Increasing server costs

Why it fails: Server costs track infrastructure spend, not divergence between training and production data distributions. Drift manifests as falling accuracy, changed feature values or shifted predictions. Rising costs warrant attention when capacity planning or budget forecasting is the audit objective.

Increased team size

Why it fails: Team size reflects staffing decisions, not changes in model inputs, outputs or behaviour. Drift appears as degrading accuracy, shifting prediction distributions or stale features. Headcount growth would be relevant when assessing operational capacity or resourcing for model review, not statistical drift.

Slow Git repository commits

Why it fails: Commit frequency measures development activity, not model behaviour change after deployment. Drift shows as performance decay, altered input distributions or prediction shift. Slow commits would matter when auditing release cadence or engineering throughput, not production model drift.

Reducing inference latency

Why it fails: Reducing inference latency is a performance optimisation, not a privacy attack; model inversion reconstructs training data by querying the model's outputs. Latency tuning would be the right concern when the requirement is real-time scoring throughput, not confidentiality of training samples.

Increasing training bias

Why it fails: Training bias concerns skewed or unrepresentative data producing unfair predictions, not reconstruction of training samples from model outputs. Bias mitigation would be the correct choice when the requirement is fairness across demographic groups rather than confidentiality.

Overfitting the data

Why it fails: Overfitting raises inversion susceptibility but is not inversion itself; inversion is the attack that exploits confidence outputs to reconstruct training records. Overfitting would be the correct focus when tuning regularisation to improve generalisation on held-out data.