Page 133 - CyberSecurityEssentialsEnglish

● Remember: Section summary
• Key idea: A tool that handles prose well may still fail on a scan, a recording, or a table.
• Practical decision: Test the medium you actually work in, and give exact operations to a
calculation tool rather than to a language model.
• Mistake to avoid: Assuming that support for a file type means correct reading of its
structure, its numbers, and its layout.

3.7 How Do We Read a Provider’s Documentation?

◆ Key idea: a marketing claim is not evidence.
Look for the definition of the scenario, the data, the measures, the version, the limits, the
license, and the data policy. Then verify locally.

Model Cards, System Cards, and Datasheets

Mitchell and colleagues proposed model cards to document intended uses, measures, limits,
and the groups concerned [3]. Gebru and colleagues introduced datasheets for datasets to
document the motivation for collecting data, its composition, its processing, and its uses [4].

These documents do not guarantee quality, but they provide structured questions for
accountability.

System card is a name used by some organizations for a document that describes the whole
system, its safety testing, its tools, and its policies. There is no single global format for it.
Read what it covers and what it excludes. A card may also be older than the version running

in the application, so check the version number, the publication date, and the change log.
Examples include system cards that publish safety results, limits, and model behavior across

different scenarios [22].

132