Fire/EMS reviews IR coverage for model drift and hallucination crises. What limitation should the plan document?
Select an answer to reveal the explanation.
Short Explanation
Antivirus scripts don’t catch a drifting model telling wrong street advice. Document that classic malware IR isn’t enough for AI-specific crises.
Full Explanation
Fire/EMS IR coverage for model drift and hallucination crises must document a core limitation: traditional malware IR alone is insufficient. Malware playbooks target malicious code, IOCs, and host containment; model drift and hallucinations are behavioral integrity and safety failures that need content evaluation, model rollback, retrieval grounding checks, and clinical/operational validation—not only antivirus sweeps.
Claiming malware playbooks already cover every GenAI failure mode fails because the detection signals and fixes differ. Ignoring hallucinations because they are “not incidents” fails safety governance when wrong street, dosing, or procedural advice can harm the public. Treating model drift as only a marketing concern fails conceptually: drift is an operational and safety risk for emergency guidance systems.
Exam caveat: AI IR expands the incident taxonomy beyond malware to include drift, hallucination, data poison, and unsafe output events. Operational check: amend the IR plan to state the malware-IR limitation explicitly, attach AI-specific playbooks for drift/hallucination, and train responders on when to disable GenAI advice channels versus when to run classic malware containment.