During an AI governance review, an auditor finds that the organization uses an open-source LLM fine-tuned on proprietary customer data. The model weights are stored externally on a cloud provider's infrastructure. Which AI supply chain risk is MOST relevant?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — c is correct because proprietary customer data used for fine-tuning can be extracted from model weights through model inversion or membership inference attacks, and storing weights externally compounds this exposure. A is a model quality issue, not a supply chain risk.
Full explanation below image
Full Explanation
C is correct because proprietary customer data used for fine-tuning can be extracted from model weights through model inversion or membership inference attacks, and storing weights externally compounds this exposure. A is a model quality issue, not a supply chain risk. B is an inference-time attack risk, separate from supply chain. D is not inherently true; open-source models are used in regulated industries with proper controls.