City security rejects a proposal for a public-facing AI tool. Which sole control is inadequate?
Select an answer to reveal the explanation.
Short Explanation
Hiding the recipe isn’t a security program. Obscuring model weights alone won’t protect a public-facing city AI—you need real architecture controls.
Full Explanation
For a public-facing city AI tool, security through obscurity of model weights as the only control is inadequate. Hiding weights may slightly raise the cost of model theft, but it does not authenticate callers, validate inputs, detect abuse, ensure integrity of what is served, or protect data—adversaries still attack the exposed interface. Proper architecture combines layered controls: access control, input validation, monitoring, integrity checks, and related defenses. Recognizing obscurity-alone as insufficient is a core judgment for Domain 8-style civic AI security questions.
Input validation combined with auth, monitoring, and integrity checks is a coherent control set, not a sole weak control. Defense-in-depth spanning data, serving, and runtime layers is likewise appropriate architecture. Least-privilege access plus signed models and API protection addresses identity, integrity, and exposure. Those options strengthen security; obscurity-only does not.
Exam caveat: the stem asks which sole control is inadequate—obscurity of weights. Do not reject layered answers that correctly describe real architecture.
Operational check: reject proposals that rely only on keeping weights secret; require a control matrix covering authN/Z, validation, integrity, monitoring, and data protections before approving any public-facing municipal AI deployment.