A library director asks how switching from a self-hosted library chatbot to a vendor-hosted LLM changes the offensive testing plan. What is the key implication?

Switching a library chatbot from self-hosted to vendor-hosted LLM changes where trust boundaries and evidence live. Hosted deployments emphasize vendor APIs, tenancy isolation, vendor logging, model versioning, and contractual shared responsibility. Self-hosted emphasizes city-controlled infrastructure, configs, local model serving, and who can change system prompts or plugins. Offensive testing plans must adjust recon, configuration review, and rules of engagement accordingly. Neither model removes prompt, retrieval, or tool risks; each relocates controls.

Observing that deployment affects residency and latency while core threat classes stay consistent is true but answers a different question than the key implication asked here—the key shift is in shared-responsibility surfaces (who controls prompts, configs, and logging), not just residency or latency metrics. Prioritizing vendor SOC 2 attestations and uptime SLAs for hosted assessments—or infrastructure warranty coverage for self-hosted—mistakes compliance paperwork for offensive scope; API behavior, tenancy, and contractual clauses still define what can be tested under authorization. Saying hosted testing should focus on city firewall patch cycles and proxy rules while self-hosted focuses on vendor tenant isolation enforcement inverts the model: hosted testing belongs on vendor APIs, tenancy, and logging, while self-hosted belongs on the city-controlled stack and configs.

Exam caveat: hosting model changes recon and shared responsibility; it does not erase AI application risks, and SOC 2 attestations, uptime SLAs, or warranty coverage do not shift the authorization boundary. Operational check: rewrite the library chatbot test plan to match hosting—city stack/config review for self-hosted versus API/tenancy/logging/contract review for hosted—and keep prompt/RAG/tool tests in both under MoU.