Security testing of a deployed image-classification model focuses on one specific threat: an attacker who, at inference time, adds small perturbations to a submitted image that are imperceptible to a person yet cause the model to output the wrong label. The team wants the test procedure that directly probes resilience to this threat. Which testing approach targets it most precisely?
- AInjecting mislabelled or corrupted records into the training corpus and observing how the retrained model behaves afterwards.
- BIssuing many crafted queries to reconstruct the model's parameters or training data, then checking what an attacker could recover.
- CReplaying historical production traffic at high volume to confirm the serving system keeps responding under heavy load.
- DGenerating adversarial examples through small, targeted perturbations of inputs and measuring how often they flip the model's predictions. Correct
Why A is wrong: This describes a data-poisoning test, which is a real security concern but attacks the training stage, so it does not probe the inference-time perturbation threat in question.
Why B is wrong: Model-extraction and membership-inference testing addresses confidentiality, which is plausible under a security heading, but it targets information leakage rather than perturbation-induced misclassification.
Why C is wrong: Load and stress testing checks availability and performance, so it is tempting as a robustness measure, yet it does nothing to assess whether perturbed inputs can fool the classifier.
Why D is correct: Crafting perturbed inputs and measuring induced misclassification is the direct test for evasion attacks at inference time, which is exactly the threat described.