A water utility maps AI supply-chain threats before adopting pretrained components. Which threat set belongs in the review?
Select an answer to reveal the explanation.
Short Explanation
Pretrained doesn’t mean pre-trusted. Poisoned weights, shady plugins, and blank model cards are supply-chain threats—put them on the map.
Full Explanation
A water utility mapping AI supply-chain threats before adopting pretrained components must include upstream AI integrity threats, not facilities trivia. Poisoned pretrained weights, compromised plugins, and opaque model cards belong in the review because they describe how malicious or untrustworthy AI artifacts enter the municipal stack: poisoned weights can embed backdoors or biased behavior; compromised plugins can execute or exfiltrate; opaque model cards hide lineage, intended use, and known limitations needed for civic acceptance.
Only threats from office snack vending machines fail by concept: vending machines are not AI component supply-chain threats. Only threats related to landscaping contracts fail by concept: landscaping procurement does not address pretrained AI artifact risk. The claim that pretrained components never introduce supply-chain risk fails by concept: pretrained components are a primary vector for upstream AI supply-chain exposure.
Exam caveat: mapping threats is not the same as proving a specific component is poisoned; the item tests threat identification for due diligence. Opaque model cards are a transparency/control threat even when the weights are benign.
Operational check: before adopting pretrained components for utility AI, maintain a threat checklist that includes poisoned weights, compromised plugins, and opaque model cards; require provenance, hashing/signature checks where available, plugin allowlists, and minimum model-card content; and reject components that cannot meet those acceptance criteria for production water-utility use.