CAIS study plan

Distinguish the scope and function of the major AI risk frameworks (NIST AI RMF's GOVERN/MAP/MEASURE/MANAGE, ISO/IEC 42001 management-system clauses, ISO/IEC 23894 risk process, EU AI Act risk tiers) and state in one sentence what each is and is not for.

Classify three realistic AI use cases (customer-support LLM, CV screening model, fraud-scoring model) into EU AI Act risk tiers and justify each classification against the prohibited and high-risk annex criteria.

Draft ten risk statements in a register, each with a named owner, an affected asset, a likelihood/impact rating and the framework function that treats it.

Define the role split between AI product owner, model risk, security engineering and legal/privacy for approving a model release, and identify where security can veto a launch.

Write a one-page AI usage policy section covering acceptable use, human oversight and prohibited model behaviours, in policy language a non-technical approver can sign.

Differentiate the core adversarial ML attack families (data poisoning, backdoor/trojan, evasion, model extraction, membership/property inference, direct and indirect prompt injection, model DoS) by attacker goal, access level and observable signal.

Explain adversarial example mechanics: perturbation budgets, transferability between models, white-box versus black-box attacks and why defences such as adversarial training trade robustness for accuracy.

Enumerate threats across the ML pipeline stages (data collection, labelling, feature engineering, training, packaging, serving) and map each to a MITRE ATLAS tactic and technique ID.

Trace a published-style indirect prompt injection path through a RAG assistant that ingests third-party documents, and describe where retrieval filtering and output constraint would break the chain.

Pair every threat in the pipeline map with one preventive and one detective control, noting which controls are cheap versus which require re-architecture.

Secure the AI supply chain by specifying dataset and model provenance, hash-pinned artefacts, a model/dataset bill of materials, signature verification and a private artefact registry.

Apply least privilege across the MLOps pipeline: separate service identities for ingestion, training, evaluation and serving; scoped registry tokens; no production data credentials in notebooks.

Configure a hardened model serving endpoint: authentication, authorization per consumer, rate limiting, input size caps, network isolation and disabled debug or shell endpoints.

Institute release gating that requires evaluation results, a security review, a red-team sign-off and an approved model card before promotion to production.

Describe how to detect and roll back a compromised model artefact, including kill-switch, canary and version pinning mechanics.

Execute at least eight attack test cases against a locally hosted open-weight model in a sandbox: direct jailbreak, indirect injection via retrieved document, prompt leaking, and an extraction attempt, recording inputs, outputs and reproduction steps.

Attempt a small-scale label-flip poisoning run on a toy classifier and measure the accuracy and trigger-activation delta to make poisoning risk concrete rather than theoretical.

Harden the serving endpoint based on findings: add input/output filtering, constrain tool and function calling, and re-test the same eight cases to confirm which are now blocked.

Document residual risk for each case that remains exploitable, with a severity rating and an accepted-risk or fix-required decision.

Classify AI data by sensitivity and function: training corpora, RAG document stores, prompts and completions, embeddings, fine-tuning sets, evaluation logs and telemetry.

Map the privacy risks specific to each class, including memorization and verbatim extraction, embedding inversion, PII leakage into logs and prompts, and re-identification from nominally anonymized training data.

Select and justify privacy-enhancing techniques (pseudonymization, differential privacy, aggregation, redaction at ingest) and state the utility cost each imposes.

Define retention, deletion and residency rules that survive model retraining, including how to honour an erasure request when data is baked into weights.

Assess dataset licensing, consent basis and documentation duties, and specify what a datasheet must record for each training corpus.

Define AI-specific telemetry beyond standard logs: prompt and completion capture with privacy controls, refusal and blocked-output rates, retrieval hit anomalies, drift metrics and embedding-space outliers.

Write five detection rules that would fire on a production prompt injection campaign, a model extraction sweep, a sudden refusal-rate collapse and a data-exfiltration pattern.

Build an AI incident taxonomy and playbook covering model compromise, injected instruction in production, training data leakage, harmful model output, supply chain tampering and silent drift.

Specify the assurance stack: continuous evaluation suites, red-team cadence, third-party model attestation and what evidence each produces for an auditor.

Draft the containment decision tree for a suspected model compromise, including when to disable a model versus degrade to a fallback.

Consolidate control evidence from weeks 1-6 into an audit-ready index mapped to ISO/IEC 42001 clauses and NIST AI RMF functions, marking each control as evidenced, partial or missing.

Run a 90-minute tabletop exercise on a production prompt injection leading to data disclosure, with assigned roles and a timed decision log.

Define model risk KPIs and thresholds (drift tolerance, red-team finding closure time, injection block rate) that governance can report monthly.

Write the after-action section of the tabletop, identifying three process gaps and the owner and due date for each.

Complete two full timed practice exams under exam conditions and score each by domain, not just overall.

Re-drill the two weakest domains using targeted question sets until domain-level accuracy exceeds 85 percent.

Distil each domain into a single-page recall sheet: framework names and functions, attack families, privacy techniques, pipeline controls, incident signals.

Review every missed question and write the underlying fact or reasoning error in one line so it is retrievable, not just re-read.