Question

A financial services company deploys a production image-classification model that approves or rejects check deposits based on scanned images. A red team demonstrates that by adding carefully crafted, human-imperceptible pixel noise to fraudulent check images, they can reliably force the model to misclassify forged checks as legitimate at inference time. The training pipeline and model weights were never accessed. Which mitigation most directly addresses this specific attack?

Accepted Answer

Implement adversarial training and input preprocessing (e.g., feature squeezing/randomized transformations) combined with confidence-threshold rejection at inference

Answer

Enforce data provenance validation and cryptographic signing of the training dataset before each retraining cycle

Answer

Restrict API access with OAuth scopes and add per-client rate limiting to the inference endpoint

Answer

Encrypt the model weights at rest in an HSM and enable full-disk encryption on the inference servers