Responsible AI, Ethics, and Security
Principles
Responsible AI covers fairness, transparency and explainability, privacy, accountability, safety and human oversight. Bias enters through data, labels and design; you can only measure it if you capture the relevant group attributes. Explainability tools (feature importance, attribution methods, model explanation in Data Science) answer why a prediction was made, supporting appeals and audits. Human-in-the-loop review is expected where errors are irreversible or high-impact.
Privacy and data handling
Minimize and de-identify data; OCI Language can detect and mask PII. Anonymization irreversibly removes identifying links; pseudonymization replaces identifiers with tokens that can be re-linked with a key - not the same thing. Respect data residency and retention requirements.
Security controls
Apply least privilege with IAM policies scoped to compartments; use dynamic groups for workloads. Encrypt at rest with Vault keys and in transit with TLS; prefer private subnets and private endpoints. Log and audit API calls and rotate credentials. Secrets never belong in prompts or notebook cells.
LLM-specific threats
- Prompt injection: instructions hidden in retrieved or user-supplied content.
- Sensitive information disclosure: the model echoes secrets or personal data.
- Insecure output handling: model output passed to a shell, SQL or browser unsanitized.
- Data poisoning: corrupted training data skews behaviour.
- Excessive agency: an agent holding broad permissions. Mitigate with grounding, input and output filtering, allow-listed tool calls and human approval for destructive actions.
Traps
Deleting rows from a training set does not remove knowledge baked into weights. Encryption at rest says nothing about prompt injection. Guardrails are not a substitute for access control.
Rule of thumb
Threat-model the whole pipeline - data in, prompt in, output out - and assume any text reaching the model may be adversarial.