[Security Architecture] A financial services organization is using Al lo fully automate the process of deciding client loan rates Which of the following should the organization be most concerned about from a privacy perspective?

In the context of fully automated financial decisions, model explainability is the paramount privacy concern. Regulations such as the GDPR provide individuals with a "right to explanation" for automated decisions that have significant legal or financial effects. A lack of explainability means the organization cannot determine if the AI model is using sensitive personal data to make biased or discriminatory decisions based on protected characteristics (e.g., race, gender, age). This inability to audit the AI's logic creates a significant risk of privacy violations, regulatory non-compliance, and harm to individuals, as the basis for the assigned loan rate remains an opaque "black box."

B. Credential Theft: This is a general information security threat affecting the entire system, not a privacy issue inherent to the AI's automated decision-making process itself.
C. Possible prompt Injections: This attack is specific to generative AI and Large Language Models (LLMs). Loan rate determination typically uses predictive models, making this threat less relevant and not the primary privacy concern.
D. Exposure to social engineering: This is a threat targeting human users and operators of the system, not a privacy risk stemming directly from the AI model's function. ---

1. National Institute of Standards and Technology (NIST). (2023). Artificial Intelligence Risk Management Framework (AI RMF 1.0) (NIST AI 100-1).

Page 12

Section 3.3

"Characteristics of Trustworthy AI": The framework states

"Interpretability and Explainability refer to the extent to which a human can understand the inputs

the parts

and the outputs of an AI system... Explainability refers to a representation of the processes or procedures an AI system used to arrive at a decision." This is critical for accountability and ensuring decisions are fair and unbiased

which are core privacy principles.

2. Goodman

B.

& Flaxman

S. (2017). European Union regulations on algorithmic decision-making and a "right to explanation". AI Magazine

38(3)

50-57.

Page 50

Abstract: The paper discusses how the GDPR "will create a 'right to explanation

' whereby a user can ask for an explanation of an algorithmic decision that was made about them." This directly links automated financial decisions

like loan processing

to the legal and privacy requirement for explainability. https://doi.org/10.1609/aimag.v38i3.2741

3. Adadi

A.

& Berrada

M. (2018). Peeking Inside the Black-Box: A Survey on Explainable Artificial Intelligence (XAI). IEEE Access

6

52138-52160.

Page 52140

Section II.A

"Trust": The authors note

"In some specific domains

such as the medical or the military ones

it is crucial to be able to question

understand

and trust the decisions made by the machine... The same applies to credit denial in the banking sector." This highlights the necessity of explainability for trust and accountability in financial applications. https://doi.org/10.1109/ACCESS.2018.2870052

4. Stanford University. (n.d.). Human-Centered Artificial Intelligence (HAI) - Building Trustworthy AI.

Research Pillar on "Human-Centered AI": Stanford HAI's research emphasizes that for AI systems to be trustworthy

they must be "interpretable

fair

accountable

and aligned with human values." In a financial context

this means a system's decisions must be explainable to ensure they are not unfairly discriminating

which is a fundamental privacy and ethical concern.