Chatbots Chatbot Security and Privacy 1 — Questions and Answers
Question 1: What is a prompt injection attack in the context of AI chatbots?
- A technique where malicious input manipulates the chatbot to ignore its instructions and perform unintended actions (Correct answer)
- A method of improving chatbot responses by injecting better prompts
- A performance optimization that pre-loads common queries
- A form of data compression used to speed up chatbot responses
Correct answer: A technique where malicious input manipulates the chatbot to ignore its instructions and perform unintended actions
Prompt injection is an attack where crafted user input overrides or subverts the chatbot's original instructions, causing it to behave in unintended or harmful ways.
Question 2: What does PII stand for and why is it critical in chatbot security?
- Personally Identifiable Information — data that can identify a specific individual and must be protected (Correct answer)
- Public Internet Interface — the endpoint through which chatbots communicate
- Primary Input Interpreter — the module that processes user messages
- Peripheral Integration Interface — the API layer connecting chatbots to third-party services
Correct answer: Personally Identifiable Information — data that can identify a specific individual and must be protected
PII stands for Personally Identifiable Information, which includes names, emails, SSNs, and similar data that chatbots must handle carefully to comply with privacy laws.
Question 3: Which security practice involves deliberately testing a chatbot for weaknesses before it is deployed to users?
- Penetration testing (Correct answer)
- A/B testing
- Regression testing
- Load testing
Correct answer: Penetration testing
Penetration testing (pen testing) simulates attacks on a chatbot to discover exploitable vulnerabilities before real users can take advantage of them.
Question 4: Under GDPR, what right do EU users have regarding personal data collected by a chatbot?
- The right to request deletion of their personal data ('right to be forgotten') (Correct answer)
- The right to receive compensation for data usage
- The right to access the chatbot's source code
- The right to disable the chatbot permanently
Correct answer: The right to request deletion of their personal data ('right to be forgotten')
GDPR's 'right to be forgotten' allows users to request that their personal data be erased from the organization's systems, including chatbot conversation logs.
Question 5: What is the purpose of rate limiting in chatbot security?
- To restrict the number of requests a user or bot can make in a given time period, preventing abuse and denial-of-service attacks (Correct answer)
- To control how fast the chatbot types responses to users
- To limit the number of topics a chatbot is allowed to discuss
- To set a maximum word count for each chatbot reply
Correct answer: To restrict the number of requests a user or bot can make in a given time period, preventing abuse and denial-of-service attacks
Rate limiting caps how many requests can be sent in a time window, protecting the chatbot from brute-force attacks, spam, and denial-of-service (DoS) attempts.
Question 6: Which technique best protects sensitive user data from being stored permanently in chatbot conversation logs?
- Data masking or anonymization before storage (Correct answer)
- Storing all logs in a separate database
- Compressing logs with strong encryption only
- Sending logs to a third-party archiving service
Correct answer: Data masking or anonymization before storage
Data masking or anonymization removes or obscures sensitive values (e.g., replacing credit card numbers with asterisks) before logs are written, reducing exposure risk.
Question 7: What is the role of an API key in securing a chatbot's backend integration?
- It authenticates and authorizes external services to communicate with the chatbot's API, preventing unauthorized access (Correct answer)
- It encrypts all messages sent between the user and the chatbot
- It generates unique session IDs for each user conversation
- It monitors chatbot uptime and sends alerts when the service is down
Correct answer: It authenticates and authorizes external services to communicate with the chatbot's API, preventing unauthorized access
An API key acts as a secret credential that identifies and authenticates the calling service, ensuring only authorized clients can interact with the chatbot's backend APIs.
Chatbots Chatbot Security and Privacy 1
What is a prompt injection attack in the context of AI chatbots?