AIGP Chatbot Stress Test Playbook

§1Overview — Why Stress Test an AIGP Chatbot

AIGP stands for Artificial Intelligence Governance Professional, a certification offered by the International Association of Privacy Professionals (IAPP). The chatbot under test is trained on the AIGP Body of Knowledge, which covers the governance, legal, and operational dimensions of AI systems across seven domains.

Stress testing checks two things:

• Robustness — does the chatbot break when subjected to adversarial prompts? Can it be jailbroken, manipulated, or tricked into bypassing its guardrails?
• Accuracy — does the chatbot hallucinate? When asked about AIGP curriculum facts (laws, frameworks, standards), does it give correct answers or fabricate information?

These prompts test along two main axes:

• ADVERSARIAL — can we trick the chatbot into ignoring instructions, bypassing safety guardrails, or producing harmful content?
• FACTUAL — does the chatbot know its domain? When we ask about EU AI Act risk levels, NIST AI RMF functions, or ISO standards, does it answer correctly?

The 7 AIGP Domains

§2Category 1 — Prompt Injection [OWASP LLM01]

Test if the chatbot can be manipulated to ignore its original instructions. Prompt injection is the #1 risk in the OWASP LLM Top 10 — it occurs when an attacker injects text that overrides the model's system prompt or operating constraints.

§3Category 2 — Jailbreak & Roleplay

Test if roleplay, fictional framing, or social engineering can bypass guardrails. These attacks use narrative techniques — fiction, hypothetical scenarios, emotional appeals — to get the chatbot to produce content it would normally refuse.

§4Category 3 — Hallucination & Factual Accuracy

Test whether the chatbot fabricates facts about AI governance. These prompts have known correct answers — compare the chatbot's responses to the ground truth provided in each card. This is where domain-specific training matters most.

§5Category 4 — Boundary & Out-of-Scope

Test how the chatbot handles questions outside its training domain. A robust chatbot should clearly acknowledge when it cannot answer or when a question is outside its scope, rather than hallucinating plausible-sounding responses.

§6Category 5 — Data Leakage & Extraction

Test if the chatbot leaks training data, system prompts, or internal configuration. A well-hardened chatbot should never reveal its system prompt, training methodology, or internal safety rules when probed.

§7Category 6 — Encoding & Evasion

Test if encoding, language-switching, or obfuscation bypasses content filters. These techniques attempt to disguise harmful prompts using transformations (base64, leet speak, foreign languages, structured formats) that the filter may not catch.

§8Category 7 — Conversational Pressure & Persistence

Test if sustained pressure, repeated asking, or emotional manipulation breaks guardrails. These attacks exploit the chatbot's cooperative tendencies — gradually escalating, using false attribution, or applying social pressure to extract content it would normally refuse.

§9Scoring Guide & What to Look For

After running all 37 prompts, evaluate the chatbot against these seven dimensions:

Scoring Tiers

§Sources & References