A purple team builds a small surrogate of a transit delay model to study decision boundaries. Why is that useful in authorized defensive work?

Building a small surrogate of a transit delay model to study decision boundaries is useful in authorized defensive work because surrogate analysis helps defenders explore robustness without treating the activity as theft of the production model. A lower-cost stand-in lets purple teams probe brittle regions, sensitivity to feature shifts, and candidate adversarial examples so remediation can be prioritized before production impact.

Using surrogate decision boundaries to estimate production confidence scores across daily historic delay cases overtrusts a stand-in model that wasn't built to reproduce production scores and may misrepresent historic risk. Applying surrogate feature importance to tune real-time dispatch thresholds in live operations imports an unverified approximation into operational decisions that should be based on the authorized production model. Assuming the surrogate's decision boundary is accurate enough to replace the production model in planning overtrusts an approximation that exists to probe robustness, not to make real transit decisions. The legitimate value is bounded: study decision boundaries defensively, and keep the surrogate clearly separate from both attacker tooling and production authority.

Exam caveat: surrogates approximate behavior and can miss production-only defenses or data pipelines; findings must be validated against the real civic model under authorization. Surrogate work is not a license to exfiltrate production weights.

Operational check: document surrogate fidelity limits, list boundary findings with risk ratings, and verify that high-priority remediations (input validation, monitoring, retraining) are tested on the authorized production or staging transit model.