A county AI working group confuses theft of model weight files with a successful prompt-injection against the live 311 bot. How should security differentiate the threats?
Select an answer to reveal the explanation.
Short Explanation
You can keep the distinction clear: stealing model weights is not the same as tricking a live 311 bot. Protect model assets at rest or in transit, and treat prompt injection as abuse of inference-time inputs.
Full Explanation
Model-weight theft targets model assets at rest or in transit, such as stored weight files; prompt injection instead abuses inputs supplied to a live application at inference time, potentially steering a 311 bot away from its intended behavior. These threats are not identical, and not every GenAI issue is supply-chain fraud: the two involve different attack surfaces and call for different controls. Protect model storage and transfers with access controls and egress monitoring; address prompt injection through careful input handling, privilege separation, and output gating. Prompt injection is not confined to offline pretraining, because it can target a deployed application as it processes live inputs. The reversed description also confuses the threats: a live prompt that tricks a bot is prompt injection, while copying stored model files is weight theft. Exam caveat: stolen weights could support offline research that later informs attacks on a deployed application, but that connection does not make weight theft and prompt injection the same threat. As a practical check, classify each incident by whether model files were taken or live application inputs were abused, then verify that asset protections and inference-time defenses are tested and reported separately.