Which of the following should be done FIRST if an attacker exfiltrates sensitive information from an AI model?
Immediate containment limits additional unauthorized data disclosure and enables investigation of the compromise. Isolating impacted systems is therefore the initial incident-response action; notification, defensive tuning, and rebuilding occur after or alongside subsequent assessment, remediation, and recovery activities.
Community Discussion