Free AAISM Practice Test Questions and Answers (2026)

Conducting regular, independent audits is the most effective method for monitoring vendor compliance. Audits provide direct, verifiable assurance that the vendor's processes, controls, and outputs align with contractually mandated ethical and security standards. This approach moves beyond trust-based models like self-attestation, offering a structured and evidence-based mechanism to assess the entire AI development lifecycle. It allows the contracting organization to proactively identify gaps, enforce accountability, and ensure that principles of fairness, transparency, and security are being actively implemented, rather than just claimed.

B. Requiring vendors to monitor their adherence to ethics and security standards: This approach lacks independent verification and creates a potential conflict of interest, making it less reliable than an external audit.

C. Mandating that vendors share source code and AI documentation with the contracting party: While useful for due diligence, code and documentation review is a static, point-in-time assessment and does not guarantee ongoing process compliance.

D. Allowing vendors to self-attest ethical AI compliance and implement benchmark monitoring: Self-attestation is the weakest form of assurance, as it is not independently verified and may not accurately reflect actual practices.

1. ISACA. (2023). Artificial Intelligence Audit Toolkit. In the section on "Third-Party Management

" the toolkit emphasizes the need for organizations to "Perform audits of the third party" and "Review third-party attestation reports (e.g.

SOC 2)" to gain assurance over the controls at the vendor. This directly supports the practice of conducting audits (Option A) over relying on vendor self-monitoring or attestation (Options B and D).

2. ISACA. (2021). Auditing Artificial Intelligence. This white paper states

"The audit and assurance professional should obtain an understanding of the third-party relationships and related processes to determine whether the enterprise has implemented appropriate governance and monitoring controls." It highlights the auditor's role in verifying these controls

which is the essence of an audit. (Page 18

Third-Party Management).

3. National Institute of Standards and Technology (NIST). (2023). AI Risk Management Framework (AI RMF 1.0). In the "Govern" function

section 4.4 "AI System and Third-Party Relationships

" the framework outlines the importance of establishing processes for "monitoring and reviews of third-party providers

" including "audits

and assessments." This underscores that active

independent verification like audits is a core component of managing third-party AI risk. (Page 21).

Data minimization is a core privacy and security principle that involves processing only the data that is absolutely necessary for a specific purpose. In the context of training a large language model (LLM), applying data minimization means proactively identifying and removing any sensitive, personal, or proprietary information from the training datasets before the model is trained. This directly addresses the CISO's concerns by fundamentally reducing the risk surface. By ensuring sensitive data is not included, the organization mitigates the possibility of the model memorizing and later exposing this information, thus preventing potential data breaches and ensuring compliance with privacy regulations.

A. Data augmentation: This technique is used to increase the volume of training data to improve model accuracy and generalization, not to address security or privacy risks.

C. Data classification: This is a foundational step to identify sensitive data, but it does not, by itself, mitigate the risk; it only categorizes it.

D. Data discovery: This process locates data across systems. Like classification, it is a preliminary step that identifies the problem but does not implement a solution.

1. National Institute of Standards and Technology (NIST). (2023). Artificial Intelligence Risk Management Framework (AI RMF 1.0). (NIST AI 100-1).

Page 29

Table 7

MAP.T10: In the section on documenting training data

this subcategory explicitly lists "adherence to data minimization principles" as a key element for managing AI risks. This directly supports using data minimization to handle training data concerns.

2. ISACA. (2023). Artificial Intelligence: An Audit and Assurance Framework.

Page 21

Section 3.2.1 Data Governance: The framework states

"Data used to train AI models should be relevant

accurate and appropriate for the intended purpose... It is important to ensure that the data used for training does not contain any sensitive or confidential information that could be inadvertently exposed by the AI model." This aligns with the principle of data minimization to remove unnecessary sensitive data.

3. European Union. (2016). General Data Protection Regulation (GDPR).

Article 5(1)(c): This article establishes "data minimisation" as a core principle of data protection

stating that personal data shall be "adequate

relevant and limited to what is necessary in relation to the purposes for which they are processed." This legal and privacy principle is the direct solution to the CISO's concerns when applied to AI training data.

Open-source data repositories are centralized platforms (e.g., Kaggle, UCI Machine Learning Repository, Google Dataset Search) that host a wide variety of large, often cleaned and labeled, datasets. They are specifically designed to provide data for research, development, and testing of applications, particularly in the AI and machine learning domains. Using these repositories is the most direct, efficient, and common method for an organization to acquire the large-scale data needed for comprehensive application testing without the significant overhead of collecting and preparing the data from scratch.

A. AI model cards are documents that provide transparency about a model's performance, limitations, and ethical considerations, not a source of raw data.

B. Incorporating data from search content is impractical; it is often unstructured, may have copyright or privacy restrictions, and requires extensive effort to scrape, clean, and label.

D. AI data augmentation is a technique to artificially increase the size of an existing dataset. It cannot be used without an initial dataset to augment.

1. ISACA

Artificial Intelligence Audit and Assurance Framework

2023. In the "AI Data Life Cycle" section

the framework discusses "Data Sourcing and Acquisition

" emphasizing the need to obtain relevant and sufficient data for training and testing AI models. Open-source repositories are a primary means of fulfilling this requirement for large-scale data needs.

2. Ng

A. (2023). Machine Learning (CS229) Course Materials. Stanford University. Lecture notes and project guidelines frequently reference the use of public datasets from repositories like the UCI Machine Learning Repository and Kaggle as standard practice for obtaining data for model development and evaluation. (See

for example

project guidelines which list acceptable data sources).

3. Roh

Y.

Heo

G.

& Whang

S. E. (2021). A survey on data collection for machine learning: a big data - AI integration perspective. IEEE Transactions on Knowledge and Data Engineering

33(4)

1328-1347. This paper discusses various data collection methods

highlighting public datasets as a crucial resource. Section 3.1

"Using Existing Datasets

" explicitly states

"The easiest way to collect data is to use publicly available datasets... Many websites share public datasets

such as Kaggle

the UCI ML Repository

and the KDD Cup." This confirms that using such repositories is a primary and efficient method. (DOI: https://doi.org/10.1109/TKDE.2019.2946162)

An accountability model establishes a clear governance structure, defining roles, responsibilities, and oversight mechanisms for AI systems. This framework is fundamental to ensuring that an AI product is used ethically and responsibly throughout its lifecycle. It addresses the organization's concerns by creating clear lines of authority for managing risks related to fairness, bias, transparency, and societal impact. This model provides the foundation upon which specific tools and practices, such as model cards and security protocols, are implemented and enforced.

A. Model cards are a tool for transparency, which is a component of a responsible AI strategy, but they do not constitute the entire governance framework needed for accountability.

B. Vendor monitoring is relevant only when using third-party AI systems and does not address the organization's internal responsibility for a product it has developed.

D. Security by design is a critical practice focused on protecting the AI system from threats, but it does not cover the full spectrum of ethical considerations like fairness and bias.

1. ISACA

"Artificial Intelligence: An Audit and Assurance Framework

" 2023. Page 14

under the "AI Governance Framework" section

states

"A governance framework establishes accountability

roles and responsibilities

and decision rights... It also provides a structure for oversight to ensure that AI systems are aligned with the organization’s ethical principles."

2. National Institute of Standards and Technology (NIST)

"AI Risk Management Framework (AI RMF 1.0)

" January 2023. Section 3.1

"The GOVERN Function

" emphasizes that this function is central to responsible AI. It states

"Governance processes should be in place to ensure accountability for AI risks and their management... This includes assigning roles and responsibilities for all stages of the AI lifecycle."

3. Mittelstadt

B. (2019). "Principles alone cannot guarantee ethical AI." Nature Machine Intelligence

1(11)

501-507. This academic paper argues that high-level ethical principles are insufficient without practical implementation through "mechanisms of accountability" and robust governance structures to translate principles into practice. (DOI: https://doi.org/10.1038/s42256-019-0114-4)

A Key Risk Indicator (KRI) for an AI risk management program should measure the program's effectiveness in governing AI initiatives and ensuring they adhere to established policies and controls. The "Percentage of AI projects in compliance" is the most direct measure of this effectiveness. It quantifies how well the organization's AI activities are following the prescribed risk management framework, including mandatory assessments, controls, and documentation. A high compliance rate indicates a successful and effective program, while a low rate serves as an early warning that the program is not being implemented properly, increasing overall AI-related risk.

A. Number of AI models deployed into production: This is a volume or activity metric. It indicates the scale of AI adoption and potential risk exposure but does not measure the effectiveness of the program managing that risk.

B. Percentage of critical business systems with AI components: This metric measures the organization's inherent risk or attack surface related to AI. It identifies where risk management is crucial but does not evaluate how well it is being performed.

D. Number of AI-related training requests submitted: This is an ambiguous indicator. It could signify a positive culture of risk awareness or, conversely, a lack of adequate foundational training, but it does not directly measure the program's control effectiveness.

1. NIST AI Risk Management Framework (AI RMF 1.0): The "Measure" function of the framework is dedicated to tracking risk management effectiveness. It states

"Measurement enables learning from experience and improves the design

development

deployment

and use of AI systems." A compliance metric directly aligns with this goal of evaluating and improving risk management practices. (Source: NIST AI 100-1

January 2023

Section 4.4

"Measure

" Page 21).

2. ISACA

"COBIT 2019 Framework: Governance and Management Objectives": While not AI-specific

COBIT provides the foundational principles for IT governance that ISACA applies to new domains. The management objective APO12

"Manage Risk

" includes example metrics like "Percent of enterprise risk and compliance assessments performed on time." The "Percentage of AI projects in compliance" is a direct application of this established principle to the AI domain

measuring adherence to the defined risk management process. (Source: COBIT 2019 Framework

APO12

Page 113).

3. Thelen

B. D.

& Mikalef

P. (2023). "Artificial Intelligence Governance: A Review and Synthesis of the Literature." Academic literature on AI governance emphasizes the need for "mechanisms for monitoring and enforcement" to ensure compliance with internal policies and external regulations. A KRI measuring the percentage of projects in compliance is a primary tool for such monitoring and enforcement

directly reflecting the governance program's effectiveness. (This is a representative academic concept; specific DOI would vary

but the principle is standard in AI governance literature).

Adopting a phased approach is the most effective strategy for managing the security risks associated with integrating a novel technology like AI. This method allows an organization to introduce AI capabilities incrementally, starting with pilots or limited-scope projects. Each phase serves as a controlled environment to identify, assess, and mitigate emergent security risks before they can impact the entire enterprise. This iterative process facilitates learning, allows for the refinement of security controls and governance policies, and ensures that the complexities and potential vulnerabilities of AI are understood and managed before scaling up. It is a foundational risk management practice for complex technology adoption.

A. Re-evaluating the risk appetite is a critical governance activity that sets tolerance levels but does not, by itself, constitute a management strategy for implementation risks.

B. Seeking third-party advice is a valuable, supportive measure for gaining expertise but is not the primary, overarching strategy for managing the integration process.

C. Evaluating compliance requirements is essential for establishing a baseline and avoiding legal penalties but often fails to address novel, technology-specific security risks not yet covered by regulations.

1. ISACA

COBIT® 2019 Implementation Guide

2018. Chapter 3

"The Implementation Lifecycle

" details a seven-phase

iterative approach. Phase 4

"Plan

" and Phase 5

"Design

" emphasize planning for incremental implementation. This phased methodology is a core principle for managing risk during the implementation of any significant IT change

including AI. The guide states

"The lifecycle should be iterative

meaning that the enterprise can cycle through the phases as needed." This directly supports a phased approach for managing complex integrations.

2. ISACA

"Auditing Artificial Intelligence

" White Paper

2021. Page 14 discusses the "AI Journey" and the importance of starting with pilot projects. It states

"The AI journey is a marathon

not a sprint... It is important to start small with a few pilot projects to learn and build momentum." This recommendation to "start small" is the essence of a phased approach to manage the risks and complexities of AI adoption.

3. Hiekkanen

K.

et al. "This Time It’s Different? A Review of the AI Governance Literature." Proceedings of the 53rd Hawaii International Conference on System Sciences

2020. (https://doi.org/10.24251/HICSS.2020.638). The paper discusses AI governance frameworks

which often implicitly or explicitly recommend iterative and adaptive strategies for AI adoption. The concept of "sandboxing" and pilot programs is highlighted as a key mechanism for exploring AI's potential while containing risks

which is a form of a phased approach.

The greatest challenge in applying copyright law to AI-generated content is determining rightful ownership. Traditional copyright frameworks, such as the U.S. Copyright Act, are predicated on the principle of "human authorship." Because an AI is not a legal person, it cannot be considered an "author" in the legal sense. This creates a fundamental conflict: if there is no human author, it is unclear who, if anyone, owns the copyright. The debate involves whether ownership should fall to the user providing the prompt, the AI developer, the owner of the computing resources, or if the work should enter the public domain. This foundational issue of authorship and ownership must be resolved before other issues, like licensing, can be effectively addressed.

A. Enforcing trademark rights is concerned with the branding of the AI system itself (e.g., its name or logo), not the copyright of the content it generates.

C. Protecting trade secrets applies to the AI's underlying algorithms, models, and training data, which are distinct from the copyright status of the AI's output.

D. Establishing licensing frameworks is a secondary issue that depends entirely on first resolving the primary challenge of who holds the ownership rights to be licensed.

1. U.S. Copyright Office. (2023). Copyright Registration Guidance: Works Containing Material Generated by Artificial Intelligence. Federal Register

88(51)

16190-16194.

Page 16192

Section III.A: The guidance states

"the Office will not register works produced by a machine or mere mechanical process that operates randomly or automatically without any creative input or intervention from a human author." This directly highlights that the lack of human authorship is the central barrier to establishing copyright

and thus ownership.

2. World Intellectual Property Organization (WIPO). (2020

May). WIPO Conversation on Intellectual Property (IP) and Artificial Intelligence (AI): Revised Issues Paper on Intellectual Property Policy. WIPO/IP/AI/2/GE/20.

Page 11

Issue 11: Authorship and Ownership: The paper explicitly poses the core question: "Should copyright be attributed to original literary and artistic works that are autonomously generated by AI? If so

who should be considered the author or owner of the copyright...?" This frames the ownership question as the primary policy challenge for international IP bodies.

3. Stanford University Human-Centered AI (HAI). (2023

September 12). Generative AI and the Future of Work.

In the section on "Intellectual Property

" the report discusses the legal ambiguity surrounding AI-generated works

stating

"Current U.S. copyright law protects only works with human authors

leaving the ownership of purely AI-generated content in a gray area." This reinforces that ownership is the central unresolved issue.

A model card is a standardized documentation artifact designed to increase transparency and accountability for machine learning models. It provides a structured summary of a model's intended uses, performance metrics (often disaggregated across different groups), limitations, ethical considerations, and the data used for training and evaluation. By presenting this crucial information in a concise and accessible format, model cards enable various stakeholders—including developers, policymakers, and end-users—to understand the model's capabilities and risks. This transparency is a cornerstone for building trust in AI systems, as it demonstrates due diligence and provides a basis for informed decision-making.

A. Hyperparameters: These are low-level technical settings for the training algorithm. They are not meaningful to most stakeholders and do not describe the model's real-world performance or impact.

B. Data quality controls: While essential for building a reliable model, these are processes and metrics related to the input data, not a comprehensive summary document about the finished model itself.

D. Model prototyping: This is an early, experimental phase in the model development lifecycle. A prototype is not a formal documentation artifact for a deployed model and lacks the rigorous evaluation needed for trust.

1. ISACA

Artificial Intelligence Security and Management (AAISM) Study Guide

1st Edition

2024. Chapter 3

"AI Model Development and Training

" emphasizes the need for comprehensive documentation to ensure transparency and accountability. It identifies model cards as a key tool for documenting model details

performance

and limitations to communicate effectively with stakeholders.

2. Mitchell

M.

Wu

S.

Zaldivar

A.

et al. (2019). Model Cards for Model Reporting. Proceedings of the Conference on Fairness

Accountability

and Transparency

pp. 220-229. This foundational academic paper introduces model cards as a framework to "encourage transparent model reporting" and provide stakeholders with essential information to "better understand the models." (DOI: https://doi.org/10.1145/3287560.3287596)

3. Stanford University

Center for Research on Foundation Models (CRFM). (2023). Transparency Section. The courseware and publications from Stanford's AI programs

such as those from the CRFM

consistently highlight the role of artifacts like model cards in achieving AI transparency and building trust. They are presented as a best practice for responsible AI development and deployment.

The scenario describes an attacker crafting specific inputs to bypass an LLM's built-in restrictions and manipulate its output. This technique is known as prompt injection. The attacker injects malicious instructions within the prompt, causing the model to ignore its original system-level instructions and follow the attacker's commands instead. This directly exploits the model's interpretation of input to compromise its output integrity, making it the most accurate description of the attack.

B. Jailbreaking is a specific goal or outcome of a prompt injection attack, aimed at bypassing safety and ethical filters, rather than the attack technique itself.

C. Remote code execution involves executing arbitrary code on the server, a more severe and distinct attack that is not inherently part of manipulating LLM text output.

D. Evasion is an adversarial attack that typically causes a model (e.g., a classifier) to make an incorrect prediction, which is different from overriding an LLM's core instructions.

1. OWASP Foundation. (2023). OWASP Top 10 for Large Language Model Applications. In the "LLM01: Prompt Injection" section

the vulnerability is defined as: "Prompt injection vulnerabilities allow a malicious user to manipulate the output of a Large Language Model (LLM) through crafted inputs... This can lead to data exfiltration

unauthorized access

or other security breaches."

2. National Institute of Standards and Technology (NIST). (2023). Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations (NIST.AI.100-2 E2023). Section 3.2.1

"Data/Input Poisoning

" describes how attackers can manipulate inputs. Prompt injection is cited as a prime example for LLMs where "an attacker can carefully craft a prompt to an LLM to have it ignore previous instructions."

3. Greshake

K.

Abdelnabi

S.

Mishra

S.

Endres

C.

Holz

T.

& Fritz

M. (2023). Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection. arXiv preprint arXiv:2302.12173. Section 2

"Background

" defines prompt injection as an attack where an "adversary controls a part of a prompt... to manipulate the LLM's behavior." (https://doi.org/10.48550/arXiv.2302.12173)

The right to audit is the most critical consideration because it provides the organization with the contractual authority to independently verify and validate the third-party AI tool's performance, security controls, data handling processes, and compliance with legal and ethical standards. Given the often opaque nature of AI models, this right is a fundamental governance mechanism for ongoing assurance. It allows the organization to move beyond relying solely on vendor attestations and certifications, enabling direct assessment against specific internal requirements and risk tolerances, which is the core of validation.

A. Terms and conditions: While essential, this is a broad legal document. The right to audit is a specific, crucial clause within the terms and conditions that directly enables validation.

C. Industry analysis and certifications: These are valuable for initial due diligence but are often generic, point-in-time assessments that may not cover the organization's specific use case or risk profile.

D. Roundtable testing: This is a specific, often informal, testing technique. It is only one small component of a comprehensive validation strategy, not the most important overarching consideration.

1. ISACA

Auditing Artificial Intelligence

2021. Chapter 5

"Auditing AI Governance and Risk Management

" emphasizes the importance of managing third-party AI risks. It states that contracts with AI service providers should include "clauses for independent security assessments and the right to audit to ensure that the organization’s data are adequately protected and that the AI solution is performing as expected." (Page 63).

2. ISACA

Artificial Intelligence: An Audit/Assurance Framework

2023. In the "GOVERN" function

section 3.4

"Third-Party Management

" discusses the need to "Establish and monitor third-party relationships to ensure that AI-related risks are managed." The right to audit is a primary mechanism for such monitoring and for gaining assurance over the third party's controls and processes.

3. NIST

AI Risk Management Framework (AI RMF 1.0)

January 2023. The GOVERN function (Section 4.1

GOVERN 3) discusses policies and procedures for third-party AI systems. It highlights the need for organizations to have mechanisms to understand and manage risks from externally sourced AI

for which audit and assessment rights are a prerequisite for effective implementation. (Page 21).

The primary consideration for managing liabilities from agentic AI's unforeseen behavior is establishing a robust accountability model. This model defines and assigns responsibility for the AI's decisions and outcomes throughout its lifecycle. When an autonomous system acts in an unexpected way, a clear accountability framework is essential for determining legal and ethical responsibility, guiding incident response, and addressing potential harm. It provides the foundational governance structure for managing the specific risk of liability.

A. Model dependencies are a technical aspect of an AI system's architecture; while important for operational risk, they do not primarily address the legal framework for liability.

B. Using approved base models is a risk mitigation control, but it does not eliminate the possibility of unforeseen behavior or define who is liable when it occurs.

D. An acceptable risk level is a strategic business decision that sets the threshold for risk tolerance, but it is not the mechanism for managing liability when that threshold is breached.

1. ISACA

Auditing Artificial Intelligence

2023: Chapter 2

"AI Governance

" emphasizes that a key principle of AI governance is accountability. It states

"Accountability for AI systems should be established

with clear roles and responsibilities for the development

deployment

and ongoing monitoring of AI systems." This directly links accountability models to the management of AI systems and their outcomes.

2. National Institute of Standards and Technology (NIST)

AI Risk Management Framework (AI RMF 1.0)

January 2023: The "Govern" function is foundational to the framework. Section 3.1

GOVERN-1

highlights the need to establish "policies

processes

procedures

and practices for AI risk management

including roles

responsibilities

authorities

and lines of communication." This establishes an accountability structure as a primary step in managing AI risk

including liabilities.

3. Stanford University Human-Centered AI (HAI)

An Action Plan for Advancing Trustworthy AI

2023: The report repeatedly stresses the importance of accountability mechanisms. On page 10

it calls for "clear accountability mechanisms to ensure that there is recourse and redress when AI systems cause harm

" identifying this as a critical component for building trustworthy AI and managing its societal impact

including liability.

The most effective and proactive strategy to mitigate the risk of deepfake attacks is to validate the provenance of the data source. Data provenance involves establishing and verifying the origin, history, and chain of custody of a digital asset (e.g., video, audio, image). By using techniques like cryptographic signatures, digital watermarking, or blockchain-based ledgers, an organization can confirm that the media has not been tampered with and originates from a trusted source. This approach addresses the core issue of authenticity, making it a more fundamental and reliable control than reactive detection methods or fallible human judgment.

A. Relying on human judgment for oversight: Humans are notoriously unreliable at detecting sophisticated deepfakes, as these are specifically designed to deceive human perception. This makes human judgment a weak primary control.

B. Limiting employee access to AI tools: This is an internal control that does not prevent externally generated deepfake attacks, which are a common threat vector (e.g., a phishing email with a deepfaked video).

D. Using a general-purpose large language model (LLM) to detect fraud: General-purpose LLMs are designed for text-based tasks and are not the appropriate tool for analyzing the complex visual or audio artifacts characteristic of deepfakes.

1. ISACA

Artificial Intelligence Audit Toolkit

2023. The toolkit emphasizes the importance of data integrity and governance as foundational controls for AI systems. In the section on AI-specific risks

it discusses the need for controls that ensure the authenticity and integrity of data inputs

which directly relates to validating provenance to counter threats like deepfakes. (Reference to Data Integrity and Input Validation controls).

2. Guera

D.

& Delp

E. J. (2018). "Deepfake Video Detection Using Recurrent Neural Networks." 2018 15th IEEE International Conference on Advanced Video and Signal Based Surveillance (AVSS). While focusing on detection

the paper's context highlights the challenges and the "arms race" between generation and detection

implicitly supporting the need for more fundamental solutions like provenance. The limitations of detection underscore the superiority of proactive authentication. (DOI: 10.1109/AVSS.2018.8639163).

3. MIT Computer Science and Artificial Intelligence Laboratory (CSAIL)

"Detecting Photoshopped and Fake Images." Research from MIT and other institutions consistently points to the difficulty of detection and the value of source verification. Course materials on media forensics often present provenance as a more robust solution than post-facto detection. (Reference to general principles taught in courses like MIT's 6.869 Advances in Computer Vision).

The primary goal of a red-teaming exercise for generative AI, particularly during penetration testing, is to proactively identify and understand potential failures and vulnerabilities. This is achieved by simulating adversarial attacks. Testers craft specific adversarial inputs designed to bypass safety filters or exploit weaknesses in the model's logic, thereby causing it to generate unexpected, harmful, biased, or otherwise unintended outputs. This process directly evaluates the model's resilience against malicious use and helps developers implement more robust safeguards.

B. Stress test the model’s decision-making process: Stress testing primarily evaluates system performance and stability under high load or resource constraints, which is distinct from a security-focused red-teaming goal of finding behavioral exploits.

C. Degrade the model’s performance for existing use cases: While an attack might result in performance degradation, the red team's objective is to discover the vulnerability that enables such an attack, not simply to cause the degradation itself.

D. Replace the model’s outputs with entirely random content: This is too specific and narrow. The goal is to elicit a wide range of unintended behaviors, including harmful, biased, or private information, not just to generate random outputs.

1. National Institute of Standards and Technology (NIST). (2023). AI Risk Management Framework (AI RMF 1.0).

Reference: Page 31

Section 4.3.3

"Test

Evaluation

Verification

and Validation (TEVV)." The framework states that TEVV includes "red-teaming to search for vulnerabilities and to discover whether the system can be used in unintended ways." This aligns with generating unexpected outputs from adversarial inputs.

2. Perez

E.

et al. (2022). Red Teaming Language Models to Reduce Harms: Methods

Scaling Behaviors

and Lessons Learned. arXiv preprint arXiv:2209.07858.

Reference: Section 2

"Red Teaming Methods." The paper

authored by researchers from Google

DeepMind

and affiliated universities

explicitly defines red teaming as "the practice of adversarially testing a model to find inputs that elicit harmful or otherwise undesirable outputs." This directly supports option A. (DOI not available for this version

but it is a foundational academic paper in the field).

3. MITRE. (2023). MITRE ATLAS™ (Adversarial Threat Landscape for Artificial-Intelligence Systems).

Reference: Technique: ML04-T1059

"Prompt Injection." The ATLAS framework details how adversaries "craft malicious inputs to manipulate a language model into generating unintended outputs." This is a core tactic used in red-teaming and penetration testing of generative AI.

In high-stakes applications like credit risk assessment, ensuring ethical decision-making is paramount. The "human-in-the-loop" (HITL) approach, where the AI system provides advisory outputs and a human expert makes the final decision, is the highest priority. This design embeds accountability and allows for contextual judgment that an AI model cannot replicate. A human expert can override potentially biased or unfair automated recommendations, providing a critical safeguard against algorithmic discrimination and ensuring that decisions are both explainable and ethically sound. This approach directly addresses the core requirement of preventing bias at the point of decision.

A. Regularly updating the model is a standard practice for maintaining performance, but it does not inherently address ethical concerns or bias. New data can perpetuate or even introduce new biases.

B. An appeal mechanism is a crucial reactive control for redress after a decision is made, but it is not a preventative measure integrated into the initial decision-making process itself.

D. Restricting the model to "objective" financial metrics is a flawed strategy, as these metrics can act as proxies for protected characteristics (e.g., zip code correlating with race), leading to systemic bias.

1. ISACA

Artificial Intelligence Audit Framework

2023. In the section on AI Governance and Risk Management

the framework emphasizes the need for human oversight

especially for high-risk AI systems. It states

"For high-risk AI systems

human oversight should be in place to allow for human intervention to prevent or minimize harm... The final decision is made by a human." (Domain 1: AI Governance

Section 1.3 Human Oversight and Involvement).

2. High-Level Expert Group on Artificial Intelligence

Ethics Guidelines for Trustworthy AI

European Commission

2019. This foundational document lists "Human agency and oversight" as one of the seven key requirements for trustworthy AI. It specifies that for critical decisions

the system should support human autonomy

with the final determination left to a human. It recommends "human-in-the-loop (HITL)" approaches for high-stakes domains. (Chapter II

Page 14).

3. Barocas

S.

& Selbst

A. D.

"Big Data's Disparate Impact

" California Law Review

Vol. 104

2016. This academic paper explains how seemingly neutral or "objective" criteria can function as proxies for protected classes

leading to discriminatory outcomes. It demonstrates why simply restricting data inputs (as suggested in option D) is insufficient to prevent bias. (Section II.A. The Problem of Proxies

pp. 679-685). DOI: https://doi.org/10.15779/Z38G655.

Fine-tuning is a process that adapts a pre-trained foundational model to a specific, narrower domain by continuing the training process on a smaller, curated, and high-quality dataset relevant to the organization. This technique "grounds" the model in the organization's specific context and factual data. By constraining the model's knowledge to this trusted information, it directly reduces the likelihood of it generating fabricated or nonsensical information (hallucinations) when answering user queries. It is the most direct technical control listed for mitigating this specific risk.

A. Performing model testing and validation is a detective control that identifies the presence and frequency of hallucinations but does not, by itself, mitigate or prevent them.

B. Training the foundational model on large data sets is what creates the base model. This broad, uncurated training is often a source of hallucinations, not a specific mitigation for a deployed application.

C. Ensuring model developers have been trained in AI risk is a procedural and preventative control. While important for governance, it does not directly alter the model's output or reduce hallucinations.

1. ISACA

Generative AI: A Practical Audit Approach

2023: In the section "Key Risks and Controls for Generative AI

" the risk of "Inaccurate or Fabricated Information (Hallucinations)" is discussed. A key control mentioned is to "Fine-tune with domain-specific data...to help ground the model in a specific context

reducing the likelihood of generating irrelevant or fabricated information." (Page 11

Table 1).

2. Stanford University

Center for Research on Foundation Models (CRFM)

On the Opportunities and Risks of Foundation Models

2021: The report explains that fine-tuning (referred to as adaptation) is a primary method for specializing a foundation model for downstream tasks. This specialization improves performance and alignment with desired behaviors

such as factuality. (Section 4.2

"Adaptation

" pp. 85-87).

3. Zhang

Y.

et al.

A Survey on Hallucination in Large Language Models: Principles

Taxonomy

and Mitigation

ACM Computing Surveys

2024: This peer-reviewed academic survey categorizes mitigation strategies. It places fine-tuning under "Model-based" mitigation techniques

describing it as a method to align the model's knowledge with factual data sources

thereby directly reducing knowledge-based hallucinations. (Section 5.2.2

"Supervised Fine-tuning"). DOI: https://doi.org/10.1145/3626428