AICP · Domain 3
AI Risk Management
About 35% of the exam
The risk process end to end
- Identify
- Analyze
- Evaluate
- Treat
- Accept
- Monitor
- Report
- Inherent versus residual
- exposure before and after controls
- Appetite versus tolerance
- direction versus a measurable limit
- Treatment options
- avoid, reduce, transfer, accept
- Order of measures
- design out, mitigate, then inform
- Acceptance record
- owner, rationale, conditions, review date
- Deep uncertainty
- intervals and scenarios, not points
- Integration
- extend the existing risk process
Score AI risks on the enterprise scales so they compete for the same budget as every other risk, and never in a private AI-only register
Assessments and when they apply
- Impact assessment
- effects on people and society
- Fundamental rights assessment
- certain deployers, before first use
- Data protection assessment
- high risk to personal data
- Conformity assessment
- provider proves compliance before market
- Prior consultation
- high residual risk after mitigation
- Threshold check
- does a full assessment apply
- Derogation route
- documented exception, register anyway
- Re-assessment trigger
- drift or substantial modification
- Depth
- proportional to risk and scale
Adversarial ML taxonomy
- Evasion
- crafted input at inference time
- Poisoning
- corrupt the training data or model
- Backdoor
- hidden trigger forces a chosen output
- Privacy attacks
- membership inference, inversion, extraction
- Abuse
- the system itself used for harm
- Model stealing
- queries rebuild the capability elsewhere
- Availability
- degrade until it cannot serve
- ATLAS
- tactics and techniques against ML
- Gradient sign method
- one step along the loss gradient
Security controls for AI
- Sign artifacts and verify before loading
- Scan and pin every dependency
- Adversarial training trades some clean accuracy
- Randomized smoothing costs many forward passes
- Canary tokens reveal copied data
- Sandbox tool execution with restricted scope
- Enforce hard limits outside the model
- Red team before every major release
Privacy engineering
- Differential privacy
- bounds the influence of one record
- k-anonymity
- each record hides among peers
- l-diversity
- sensitive values must vary too
- Pseudonymization
- reversible with separately held keys
- Anonymization
- re-identification no longer reasonably possible
- Federated learning
- train without centralizing raw data
- Secure aggregation
- server sees only combined updates
- Gradient leakage
- updates can rebuild training records
- Trusted execution
- protects use, side channels remain
Threat modeling AI
- Attack tree decomposes one adversary goal
- AND and OR nodes enumerate paths
- Scope decides whether retrieval gets tested
- Opaque models need black-box probing
- Behavioral testing across diverse scenarios
- Contracts cover what you cannot inspect
Privacy duties that bite
- Legal basis chosen before processing starts
- Legitimate interests need a balancing assessment
- Solely automated decisions carry extra safeguards
- The reviewer must have authority to override
- Cross-border transfers need a transfer assessment
- Erasure collides with data inside weights
- Children's consent needs parental authorization
Monitoring and drift
- Data drift
- the input distribution moved
- Concept drift
- input to target relationship changed
- Ground-truth drift
- the labeling standard itself moved
- Covariate shift
- operating outside well-trained regions
- Trend detection
- rolling baselines catch slow erosion
- Pipeline health
- upstream failures drive model risk
- Threshold
- every metric needs an owner
Human oversight
- Competence, authority and time to intervene
- A kill switch is not oversight
- Volume and speed make review nominal
- Automation bias trained into the operator
- Two people confirm a biometric identification
- Oversight designed in, never bolted on
Incident handling
- Detect
- Triage
- Contain
- Investigate
- Remediate
- Recover
- Report
- Learn
- An AI incident includes the near miss
- Serious incidents go to the market authority
- Two days for critical infrastructure disruption
- Reasonable likelihood of causation starts the clock
- Provider corrects, withdraws, disables or recalls
- A vendor notification window protects your deadline
- Fix the root cause, not the symptom
Indicators worth reporting
- Leading indicator
- low-confidence predictions rising weekly
- Lagging indicator
- assessments completed on schedule
- Control indicator
- bias testing operating as designed
- Velocity
- how fast the risk arrives
- Detectability
- silent failures rank higher
- Insurance
- transfers loss, never accountability
- Model provenance
- documented origin of weights and data
Glossary
- Confabulation
- fluent output that is false
- Membership inference
- was this record in training
- Model inversion
- reconstruct inputs from model outputs
- Machine unlearning
- remove one record's learned influence
- Calibration error
- confidence against observed accuracy
- Out of distribution
- inputs unlike the training data
- Effective challenge
- competent, incentivized, influential review
- Serious incident
- harm, infrastructure or rights breach
Reference strip: process, assess, attack, privacy, incident
Process
- Identify, analyze, evaluate, treat, monitor
- Avoid, reduce, transfer, accept
- Design out first, inform last
- Acceptance names an owner and date
Assess
- Conformity is the provider's pre-market proof
- Rights assessment is the deployer's view
- Depth scales with risk and reach
- Drift forces a fresh assessment
Attack
- Evasion, poisoning, privacy, abuse
- Backdoors wait for their trigger
- Supply chain reaches every dependent project
- Sign, pin and verify artifacts
Privacy
- Differential privacy bounds one record
- Anonymized means not reasonably re-identifiable
- Federated still leaks through gradients
- Deletion is easier outside the weights
Incident
- Detect, contain, investigate, report, learn
- Near misses count as incidents
- Report on reasonable likelihood of cause
- Logs are what makes causation provable
Quick exam traps
- Trap: Buying cyber insurance moves the accountability for the harm elsewhere
- Trap: A human in the loop is a control no matter the review volume
- Trap: Federated learning removes the need for any further privacy control
- Trap: Pseudonymized training data sits outside data protection law
- Trap: A near miss with no injured party is not an AI incident
- Trap: The clock only starts once the causal link is proven
- Trap: One thorough pre-deployment assessment covers the life of the system
cybercertprep.com · original revision sheet written from the public body of knowledge