Safety, Ethics and Compliance

Safety is the part of this field with the most confident language and the least visible

arithmetic. A model is described as safe, a filter as effective, an evaluation as thorough — and

almost none of those statements comes with a number attached, or with an account of what the

number would have to be to mean anything.

That is a problem for practitioners, because the claims are made about systems they are

responsible for. It is also what these exams actually test: not whether you believe a system is

safe, but what evidence would establish it, what a clean test result proves, and which failures

a given check cannot see.

This book supplies the measurable substrate. Not the ethics — which are contested and are not a

book's to settle — but the arithmetic underneath:

- **"We reviewed thirty and found no problems" permits a failure rate of one in eleven.**

Bounding a rate below one in a thousand takes 3,000 clean samples. The rule of three — the

bound is about 3/n — makes this arithmetic you can do while somebody is still describing their

testing.

- **A clean red-team run bounds almost nothing.** Three hundred tests against a thousand failure

modes cover 30% and leave 700 unexamined. Nobody knows the size of the space for a language

model, which is a real difficulty and does not excuse omitting it — state it as an assumption

so somebody can disagree.

- **Training has no fairness correction in it.** On a task where the true association is 50/50

by construction, a data gap of 0.80 produced an output gap of 0.804. Reproducing the imbalance

is the *optimum* of the training objective, not a failure to reach it — a model predicting

50/50 on 90/10 data would have higher loss.

- **Perfectly balanced data still produced a gap of 0.026.** That is the noise floor, and a

measured disparity of 0.03 in a real system means nothing until it is compared against one.

- **Ten repetitions is enough to memorise.** A unique seven-token string at 0.332% of a corpus

became fully recoverable from a two-token prompt. At three repetitions it was 60% recoverable

— a real leak that an exact-match test reports as a clean pass.

- **Misuse filtering is beaten by its base rate, not its quality.** A filter separating malicious

from benign requests by three standard deviations blocks 92 benign requests for every malicious

one it catches, when one request in a thousand is malicious. The same filter is fine when one

in ten is. Filters evaluated on balanced test sets overstate production performance by a factor

the test set does not contain.

- **"A human reviews the output" describes three different controls.** Full review prevents;

sampled review measures; escalated review inherits the flagging mechanism's blind spots. A

document that does not say which is describing a control nobody has characterised.

**On the constraint that shaped this book.** It would be possible to study refusal behaviour by

attempting to elicit harmful output, and bias by generating stereotyped text about real groups.

This book does neither. Every experiment measures a *mechanism* — how a known imbalance

propagates, how many repetitions make a string recoverable, what fraction of a space a test set

covers, what a review sample bounds — on synthetic, neutral tasks where the ground truth is exact

by construction.

That costs something and is stated openly: refusal behaviour is cited rather than measured. It

also buys something. Because the true answer is known by construction, "bias" has an exact

definition here rather than a contested one, and the noise floor of a perfectly fair setup can be

measured — which is the number every fairness claim should be compared against.

**On what is measured and what is not.** Ten objectives were listed from the published blueprints

and then triaged before any experiment: six are measured, two are reasoned, two are cited. The

ratio is printed on the cover. A book about safety could very easily imply more evidence than it

has, and on this subject in particular, overclaiming is itself a safety failure.

What you get:

- 8 chapters covering what a safety claim must contain, bias propagation and noise floors,

memorisation and privacy, red-team coverage, human oversight, the obligations that are not

measurements, misuse and base rates, and a final chapter of limits.

- 42 original practice questions, tagged by certification and by difficulty, where every option

is explained — not just why the right answer is right, but why each wrong answer is wrong.

- A reverse map from each certification to the chapters that serve it, in reading order.

- All the code, so every table can be regenerated.

Written to the published objectives of NVIDIA NCP-GENL, NVIDIA NCA-GENL, AWS Certified

Generative AI Developer – Professional, Databricks Certified Generative AI Engineer, and NVIDIA

NCP Agentic AI. Objectives were checked in August 2026; confirm the current blueprint with the

certifying body before you sit. Regulatory frameworks are described as of that date and this

book does not give legal advice.

You need to be able to read Python. The statistics — confidence bounds, coverage, noise floors —

are built up from the point where they are needed, and nothing in this volume assumes you have

read any other book.

Every question is original, written from published exam objectives. Nothing is reproduced from,

or based on recollection of, any live examination.