Transit engineers authorize robustness tests that slightly alter camera frames fed to a traffic-vision model used in signal-timing studies. What attack class are they evaluating?

Authorized robustness tests that slightly alter camera frames fed to a traffic-vision model used in signal-timing studies are evaluating adversarial perturbation robustness of civic computer-vision models. Adversarial perturbations are small, often human-subtle input changes crafted to flip or distort model outputs. For transit agencies, that matters because vision outputs can influence timing studies and operational analytics even when humans would still recognize the scene. The engineers are measuring whether the municipal model remains reliable under such crafted noise and what defenses (preprocessing, adversarial training, monitoring) are warranted—not redesigning street furniture.

Evaluating training-data poisoning tolerance of traffic-flow prediction pipelines addresses a different threat model—corrupting training data—rather than testing how small, crafted changes to live camera frames affect a deployed vision model's outputs. Checking membership inference resistance of archived vehicle-count datasets concerns privacy exposure of training records, not the robustness of a signal-timing vision model to adversarial frame perturbations. Measuring natural weather-shift generalization of roadside camera detection models tests performance under ordinary environmental changes, not resistance to intentionally crafted, subtle pixel perturbations. These options fail because they test other ML properties—data poisoning, membership inference, or weather generalization—rather than adversarial perturbation robustness.

Exam caveat: authorized adversarial testing is a defensive evaluation activity under change control; it is not permission to attack live signal controllers. Keep tests on offline or sandboxed feeds used for studies unless a formal safety review allows more. Also distinguish digital perturbations on frames from physical-world adversarial patches on signs; both are adversarial ML, but the stem describes frame-level alterations.

Operational check: record baseline accuracy on clean municipal camera samples, apply the authorized perturbation suite, measure output flip rates for classes that matter to timing studies, and document whether confidence thresholds or input sanitization reduce failures. Feed results into the model card and acceptance criteria before any operational reliance. If small invisible changes systematically alter counts or classifications, treat robustness as an open risk for civic vision use.