A public-health triage bot will be fine-tuned on clinic notes. How does fine-tuning most clearly change the municipal AI attack surface?

Fine-tuning a public-health triage bot on clinic notes incorporates curated datasets into model weights, expanding the municipal attack surface around training-data integrity and privacy. Poisoned or mislabeled notes can embed unwanted behaviors; sensitive examples can increase memorization and leakage risk; and post-tune evaluation becomes mandatory assurance work. Offensive and assurance programs must cover dataset provenance and behavior validation, not only prompt-time controls. Fine-tuning does not eliminate input attacks or logging risks by itself.

Claiming fine-tuning shifts sensitive clinic-note handling to inference-time access controls is false—fine-tuning bakes clinic notes into model weights, so the attack surface shifts to training-data integrity and weight leakage, not just prompt evaluation. Noting that fine-tuning does not inherently harden models against adversarial prompting is true but answers a different question than how fine-tuning changes the attack surface: the key architectural change is embedding training-data integrity and privacy risk into the weights themselves, not generic prompt robustness. Claiming fine-tuning adds differential privacy protections through standard optimization cycles is false—standard fine-tuning can memorize and leak sensitive data, and differential privacy requires explicit techniques beyond typical tuning.

Exam caveat: fine-tuning adds training-data integrity/privacy risk into weights; it does not shift sensitive handling to inference-time access controls, and it does not add differential privacy protections through standard optimization. Operational check: enforce provenance, hashing, access control, and PII minimization on clinic-note corpora; run post-tune evals for harmful behaviors and leakage; keep prompt filters and logging controls in production.