A threat actor repeatedly adds padding bytes and alters strings in a known malware sample, testing each variant against a vendor's machine-learning detection engine until one is classified as benign. The engine's model and training data were never accessed or changed. Which AI threat does this BEST describe?

Evasion attacks occur at inference time: the attacker modifies inputs so that a trained model misclassifies them, without changing the model or its training data. Adding padding, altering strings, or making other functionally irrelevant changes to malware can shift the features a classifier relies on, and iteratively testing variants lets the attacker find one that the engine labels benign while the malicious behavior is preserved. Poisoning targets the training process by inserting or mislabeling data so the model learns the wrong behavior; the stem states the training data was never accessed. Model manipulation in the sense of directly tampering with a model's parameters or files requires access to the model itself, which the attacker did not have. Prompt injection exploits language models that follow natural-language instructions in their input; a malware classifier does not interpret instructions embedded in samples, and the attack worked by changing features rather than issuing commands. Exam caveat: evasion is the AI counterpart of classic signature evasion, so a single detection layer is insufficient regardless of how advanced the model is. Operational check: combine machine-learning detection with behavioral analysis and sandboxing, monitor for repeated submissions of near-identical samples, and feed confirmed evasive variants back into supervised retraining.