AI Safety, Security, and Governance
Free AWS Certified GenAI Developer (AIP-C01) practice — 6 questions on AI Safety, Security, and Governance, with explanations. No sign-up. Full 12-question mixed test →
A healthcare AI system processes patient diagnostic images using a foundation model fine-tuned on proprietary medical data. The security team discovers that carefully crafted input images can cause the model to reveal training data patterns that could expose patient information. The system must maintain HIPAA compliance while preventing this vulnerability. Which combination of safeguards BEST addresses this model inversion attack risk?
Model inversion attacks extract training data by exploiting model outputs. Differential privacy with low epsilon (0.1) adds mathematical noise during training that provably prevents reconstruction of individual training samples. Input sanitization detects adversarial perturbations designed to trigger data leakage. CloudTrail logging enables forensic analysis of attack attempts. This directly addresses the vulnerability mechanism.
An AI system uses Amazon Bedrock to generate automated code reviews for a financial services company. During testing, evaluators discover the model occasionally suggests insecure coding patterns (SQL injection vulnerabilities, hardcoded credentials) when reviewing legacy code. The company's governance policy requires documented evidence that all AI outputs undergo security validation before deployment. Which implementation satisfies both the security requirement and the governance documentation mandate?
Model evaluation jobs with security rubrics provide systematic, documented testing of output quality. AWS Config tracking creates immutable governance records of evaluation state. Amazon A2I (Augmented AI) adds required human review with full audit trails showing who reviewed what and when - critical for compliance. This combination addresses both technical validation and governance documentation requirements with built-in traceability.
A multinational corporation deploys an AI-powered customer service agent using Amazon Lex and a foundation model backend. The system must comply with GDPR (EU), CCPA (California), and LGPD (Brazil) simultaneously. A customer in Germany requests deletion of all their data including any AI model training data derived from their interactions. The conversation history includes 18 months of support tickets. Which approach ensures complete compliance with all three regulations' data deletion requirements?
Machine unlearning is the technically correct approach for removing specific training data influence without full retraining. All three regulations require deletion of personal data when requested - technical difficulty is not a valid excuse when solutions exist. GDPR requires response within 1 month (strictest timeline). Cryptographic proof (hashing before/after) provides verifiable evidence of deletion for audit purposes. This is the only option that actually removes the data from the model while meeting regulatory timelines.
An AI safety team evaluates a custom model trained on Amazon SageMaker for detecting fraudulent transactions. Red team testing reveals the model can be fooled by adversarial examples - transactions modified by adding noise imperceptible to humans but causing misclassification. The model must maintain 99.5% accuracy on legitimate transactions while being robust to adversarial attacks. Production traffic shows 0.1% of requests exhibit adversarial characteristics. Which defense strategy provides the BEST balance of robustness and performance?
Adversarial training is the most effective empirical defense - training on adversarial examples makes models inherently robust. FGSM (Fast Gradient Sign Method) and PGD (Projected Gradient Descent) are industry-standard attack methods for generating training data. Ensemble voting adds robustness because adversarial examples often don't transfer between different model architectures. This maintains high accuracy on clean data while improving adversarial robustness, fitting the 99.5% requirement.
A company builds a content moderation system using Amazon Bedrock that must detect policy violations across text, images, and video. The system needs to comply with the EU AI Act's requirements for high-risk AI systems, including human oversight, transparency, and accuracy standards. During validation, the system shows 94% accuracy but exhibits higher false positive rates (incorrectly flagging safe content) for content in minority languages. Which modifications are REQUIRED to meet EU AI Act compliance for this high-risk application?
EU AI Act Article 13 requires high accuracy and robustness for high-risk systems - 94% with disparate performance likely doesn't meet this bar. Article 14 explicitly requires human oversight for high-risk AI. Article 11 mandates comprehensive technical documentation. Article 72 requires post-market monitoring systems. Content moderation affecting access to services is classified as high-risk under Annex III. This option addresses all four explicit regulatory requirements.
A research team deploys a large language model on Amazon SageMaker for internal document analysis. Security scanning reveals the model inadvertently memorized and can reproduce verbatim excerpts from copyrighted training materials including source code, news articles, and books. The legal team requires proof that the deployed model cannot reproduce any copyrighted content exceeding fair use thresholds. The model took 3 months and $500K to train. Which approach provides the strongest legal protection while preserving model utility?
Retraining with clean, licensed data is the only approach that eliminates copyright liability at the source - you cannot infringe copyright on data you're licensed to use. Perplexity-based memorization detection identifies when the model is reproducing training data rather than generalizing. Detailed provenance documentation provides legal evidence of good-faith efforts and licenses, critical for any litigation. While expensive, this is the only option that provides 'proof' the legal team requested. Recent case law (NY Times v OpenAI) emphasizes training data licensing.
Ready for the real thing?
The full course: two full-length practice tests, video lessons for every exam domain, hands-on labs and detailed explanations.
$54.99 $17.99 with code FREETEST33 — valid through August 22.
Get my $17.99 deal →