Evidence cards
Attempt each case before opening the solutions. All case facts are fictional teaching inputs.
Case 1 · A retrieved note tries to take control
- An assistant is authorized only to summarize an externally supplied maintenance note.
- The note includes a sentence directing the assistant to abandon the summary and send internal account data to an outside recipient.
- No dataset is being updated. The independent tool-authorization check denies the requested send; no disclosure is observed.
What best describes the attempted boundary crossing?
- Confirmed data exposure
- Indirect prompt injection
- Data poisoning during training
- Ordinary factual error only
Case 2 · Tampering before the next fine-tune
- A contributor deliberately changes reviewed safe-response examples into unsafe examples in a fine-tuning dataset.
- The build process accepts the altered dataset. Evaluation of the new model shows it repeatedly recommending the altered unsafe behavior.
- There is an audit trail of dataset changes, rather than an instruction inserted into the current user conversation.
Which primary failure fits the evidence?
- Prompt injection in the current conversation
- Sensitive-data exposure only
- Improper output handling only
- Data poisoning
Case 3 · A summary becomes executable page content
- A document assistant returns a summary containing script-bearing markup.
- The application inserts that generated string directly as active HTML into a reviewer’s page; the script executes in the browser.
- Investigators have not established how the model produced the markup. Focus on the proven application boundary, not an assumed initiating attack.
Which failure is directly demonstrated?
- Improper output handling
- Confirmed training-data poisoning
- Confirmed prompt injection
- A harmless hallucination only
Case 4 · A correct answer reaches the wrong person
- An employee asks an internal assistant a routine question about a project.
- The retrieval service uses a shared privileged account without filtering records by the employee’s access rights.
- The assistant returns accurate confidential project notes that the employee is not permitted to read. No prompt override or dataset tampering is found.
What is the observed primary problem?
- Hallucination
- Data poisoning
- Sensitive-information exposure
- Prompt injection must have occurred
Case 5 · A convincing maintenance claim has no source
- An assistant states that a fictional appliance’s official manual requires a particular setting and names a manual section.
- The reviewer checks the actual manual and confirms that neither the setting nor the cited section exists.
- No tampered input or dataset is identified, no confidential data is returned, and the response is displayed as plain text without executing actions.
Which conclusion is supported without inventing an attacker?
- Data poisoning is confirmed
- Hallucination or unsupported generated claim
- Prompt injection is confirmed
- Improper output handling is confirmed