AI Security, Privacy & Governance: the practice test

Direct injection comes from the person at the keyboard; indirect injection hides in content the system processes on their behalf: emails, web pages, retrieved documents, tool results. That difference is the threat model: the victim did nothing wrong, cannot see the attack, and the attacker can target thousands of assistants by seeding content they will eventually read. It is why 'the model processes untrusted content' must be treated as 'the model receives attacker input', and why defenses live in capability limits rather than in hoping the model ignores what it reads.

Leaks follow state. Stateless hops like load balancers do not remember tenant A's data long enough to give it to B; caches and indexes exist to remember, which is why every cache key, vector namespace, and conversation store must carry the tenant as a first-class component, enforced centrally rather than by each developer remembering. The classic bugs: a semantic cache hit across tenants, a vector query without a tenant filter, an eval dataset assembled from mixed-tenant logs. This is the same invariant as the anonymous-CDN-cache rule protecting paywalled content: shared caches serve whoever hits the key, so the key must encode who may hit it.