AIF-C01 practice question: Governance and compliance (2 of 2)

Correct order: B, C, D, E, A

1. B. Using a public consumer chatbot that staff access through a web browser. First: a public consumer service gives the bank no view of the model or its training data, so its ownership is the lowest.
2. C. Using a business software product with generative AI features built in, under an enterprise agreement. Second: the bank uses an enterprise product with generative AI built in. It still does not control the model, but the vendor agreement gives it more say.
3. D. Calling a third-party foundation model through an API from the bank's own application. Third: the bank builds its own application on a third-party model. That adds control over the application, but the provider still owns and runs the model.
4. E. Further training a foundation model on the bank's own business data to create a specialized model. Fourth: the bank customizes an existing model with its own data, so it shares ownership of the model's behavior with the provider.
5. A. Building a model's weights from scratch on training data the bank owns or acquires. Fifth: the bank trains a model from scratch and owns every part of it, so it has the most ownership and the most responsibility for controls.

Explanation

The Generative AI Security Scoping Matrix describes five scopes, from using consumer apps to building and training your own model. Further along the scale, the organization owns more of the model, its data and its controls, and must secure more of them. This question tests ordering the scopes by ownership.

Study

• Generative AI Security Scoping Matrix