Chatbot Security and Privacy Flashcards

What is a prompt injection attack in the context of AI chatbots?

Answer: A technique where malicious input manipulates the chatbot to ignore its instructions and perform unintended actions

Prompt injection is an attack where crafted user input overrides or subverts the chatbot's original instructions, causing it to behave in unintended or harmful ways.

What does PII stand for and why is it critical in chatbot security?

Answer: Personally Identifiable Information — data that can identify a specific individual and must be protected

PII stands for Personally Identifiable Information, which includes names, emails, SSNs, and similar data that chatbots must handle carefully to comply with privacy laws.

Which security practice involves deliberately testing a chatbot for weaknesses before it is deployed to users?

Answer: Penetration testing

Penetration testing (pen testing) simulates attacks on a chatbot to discover exploitable vulnerabilities before real users can take advantage of them.

Under GDPR, what right do EU users have regarding personal data collected by a chatbot?

Answer: The right to request deletion of their personal data ('right to be forgotten')

GDPR's 'right to be forgotten' allows users to request that their personal data be erased from the organization's systems, including chatbot conversation logs.

What is the purpose of rate limiting in chatbot security?

Answer: To restrict the number of requests a user or bot can make in a given time period, preventing abuse and denial-of-service attacks

Rate limiting caps how many requests can be sent in a time window, protecting the chatbot from brute-force attacks, spam, and denial-of-service (DoS) attempts.

Which technique best protects sensitive user data from being stored permanently in chatbot conversation logs?

Answer: Data masking or anonymization before storage

Data masking or anonymization removes or obscures sensitive values (e.g., replacing credit card numbers with asterisks) before logs are written, reducing exposure risk.

What is the role of an API key in securing a chatbot's backend integration?

Answer: It authenticates and authorizes external services to communicate with the chatbot's API, preventing unauthorized access

An API key acts as a secret credential that identifies and authenticates the calling service, ensuring only authorized clients can interact with the chatbot's backend APIs.