A company is establishing an AI red team program and needs to define the scope of a red team exercise against their customer-facing Azure OpenAI-powered chatbot. Which elements must the scope document include to ensure a safe and legally authorized test?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — a is correct because a red team engagement scope document for AI systems must include: (1) the specific target system (the Azure OpenAI deployment endpoint URL and deployment name) to prevent testing the wrong resource, (2) test duration and time windows to coordinate with operations and avoid disrupting production, (3) authorized attack types (prompt injection, jailbreak testing, data extraction probing) with explicit exclusions (no denial of service, no accessing production customer data), (4) out-of-scope restrictions (other systems not part of the test), and (5) written authorization from the system owner (a 'get out of jail free letter') to ensure the test is legally authorized. These elements prevent unauthorized testing and ensure accountability.
Full explanation below image
Full Explanation
A is correct because a red team engagement scope document for AI systems must include: (1) the specific target system (the Azure OpenAI deployment endpoint URL and deployment name) to prevent testing the wrong resource, (2) test duration and time windows to coordinate with operations and avoid disrupting production, (3) authorized attack types (prompt injection, jailbreak testing, data extraction probing) with explicit exclusions (no denial of service, no accessing production customer data), (4) out-of-scope restrictions (other systems not part of the test), and (5) written authorization from the system owner (a 'get out of jail free letter') to ensure the test is legally authorized. These elements prevent unauthorized testing and ensure accountability. B is wrong because model architecture and weight files are not typically required for a behavioral red team exercise (which is a black-box or gray-box test) and sharing model internals may violate IP policies. C is wrong because certifications demonstrate competency but do not define the legal scope or authorization for the specific test. D is wrong because a list of chatbot users is irrelevant to defining the technical and legal scope of a red team exercise.