A community apiary-inspection lead asks whether shadow AI is the same as context manipulation, request manipulation, data poisoning, and malicious generated code. How should those ideas be distinguished?
Select an answer to reveal the explanation.
Short Explanation
Different shelves in the syllabus pantry. Context manipulation, request manipulation, data poisoning, and malicious generated code are Chapter 3 attack vectors. Shadow AI is unapproved use, with its own security, compliance, and IP consequences.
Full Explanation
Shadow AI refers to generative AI use without formal approval or oversight and carries information-security/privacy, compliance/regulatory, and intellectual-property/licensing risks. Context manipulation, request manipulation, data poisoning, and malicious generated code are Chapter 3 attack vectors and must not be folded into the shadow-AI definition when a community apiary-inspection lead asks whether they are the same. Treating shadow AI as the official name for all four attack vectors listed together conflates adoption risk with adversarial threat catalogs. Saying shadow AI replaces Chapter 3 vectors and is tested with neuron coverage mixes GenAI-for-testing adoption with CT-AI SUT measurement. Limiting shadow AI to choosing the wrong LLM for infrastructure fit reduces it to a selection mismatch and ignores the unapproved-use definition. Exam caveat: keep Chapter 3 attack vectors and Chapter 5 shadow AI conceptually separate on the written exam. Operational check: if apiary inspectors use unapproved GenAI, label it shadow AI and address approval and the three risk categories; handle named attack vectors under their Chapter 3 controls instead. Keep civic testware subject to the same review discipline you would apply to human-authored packs.