A public-health chatbot pilot can answer symptom FAQs, retrieve clinic guidance, and call a scheduling plugin. Which description best captures the layered AI threats the city SOC should inventory?
Select an answer to reveal the explanation.
Short Explanation
Picture three locked doors on one hallway: what residents type in, what private data sits in context or logs, and what plugins the bot can call. Attackers, or just sloppy design, can lean on any one door—so you inventory all three layers, not just one.
Full Explanation
A public-health chatbot that answers symptom FAQs, retrieves clinic guidance, and calls a scheduling plugin presents layered AI threats that the city SOC must inventory together. Prompt abuse can steer unsafe advice; context, retrieval, and conversation logs can leak sensitive health-related data; and plugins can misuse scheduling or messaging integrations. Offensive AI foundations treat these as concurrent control planes—input, data/privacy, and integration—so findings drive filters, data minimization, and plugin least privilege rather than a single vulnerability class.
Limiting the inventory to prompt abuse and jailbreak risks in the FAQ and clinic-guidance workflows captures one real layer accurately, but it stops at the input plane and leaves context/log data leakage and plugin misuse off the city SOC's radar entirely—a narrower slice presented as if it were the whole picture. Treating training-data bias as something output guardrails can simply offset discounts how guardrails only filter responses after generation, leaving prompt abuse, context/log data leakage, and plugin misuse largely unaddressed. Narrowing focus to plugin and tool-invocation risk around the scheduling calls is the correct integration-layer concern on its own, but by itself it says nothing about prompt abuse at the input layer or sensitive data sitting in context and logs, so it still isn't the combined threat picture the SOC needs.
Exam caveat: layered AI threat models for civic health assistants cover prompts, data exposure, and plugins concurrently—not prompt abuse alone, bias/guardrails alone, or plugin risk alone. Operational check: map the pilot's prompt paths, PII in context/logs, and each plugin's permissions; validate moderation and least privilege under an authorized MoU; escalate if scheduling tools can act without authentication or audit.