Databricks Generative AI Engineer Associate Question 257
Select 3You are developing a Generative AI application deployed on Databricks, and you need to ensure the system can handle malicious user inputs effectively. Which of the following techniques should you implement to safeguard the application?
- A
Validate user inputs against a predefined schema to ensure they conform to expected formats.
- B
Use rate limiting to restrict the frequency of API calls made by individual users.
- C
Implement fine-grained access control to restrict unauthorized access to the application.
- D
Monitor the application for prompt injection attacks and sanitize user-provided prompts.
- E
Disable logging of user inputs to avoid storing sensitive or malicious data.
Show answer and explanation
Correct answers: A, B, D
Explanation
To protect against malicious user inputs in a Generative AI application, it's essential to validate inputs to ensure they are well-formed, limit the frequency of user requests to avoid abuse, and sanitize prompts to prevent injection attacks. These measures collectively strengthen the guardrails around the system while ensuring it behaves as intended under potentially hostile conditions.
- A. Correct.
Validating user inputs against a predefined schema helps ensure that only well-formed and expected inputs are processed by the Generative AI model, reducing the risk of malicious inputs.
- B. Correct.
Rate limiting prevents automated attacks or misuse of the API by restricting the number of requests a user can make within a specific timeframe.
- C. Incorrect.
While fine-grained access control is a good security practice, it primarily addresses access management rather than mitigating malicious user inputs.
- D. Correct.
Monitoring for and sanitizing user-provided prompts is crucial to prevent prompt injection attacks, which can manipulate the behavior of the Generative AI model.
- E. Incorrect.
Disabling logging of user inputs can help with privacy but does not directly protect against malicious inputs. Instead, sensitive data should be logged securely and sanitized if necessary.