A global investment bank's CISO is developing a cybersecurity framework specifically for AI systems used in trading and risk management. The security team identifies that AI models introduce unique attack surfaces beyond traditional software. Which of the following represents a cybersecurity threat that is UNIQUE to AI/ML systems and does NOT have a direct equivalent in traditional application security?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Traditional software doesn't learn from data — so you can't poison it the way you can poison a model. Data poisoning is uniquely ML: an attacker slips bad training examples into your data pipeline, and the model quietly learns the wrong thing. By the time it's deployed, the vulnerability is baked into the weights, invisible to conventional security scanning. That's a threat class that simply doesn't exist in rule-based software.
Full explanation below image
Full Explanation
AI and ML systems introduce a new attack surface that does not exist in traditional rule-based software: the training pipeline and learned model weights. Because ML models derive their behavior from data rather than explicit programming, attackers can manipulate model behavior by corrupting the data the model learns from, without ever touching the code.
Data poisoning (Option B) is a supply-chain attack targeting the training process. In a financial context, an adversary with access to the training data pipeline (e.g., a compromised data vendor, an insider threat, or a corrupted market data feed) can inject carefully crafted data points that cause the model to learn subtly wrong patterns. For example, a poisoned fraud detection model might learn to classify a specific account number range as 'not fraudulent,' effectively creating a backdoor. Detection is extremely difficult because the model's inference code is correct—the compromise exists in the weights.
Option A describes SQL injection, a classical application security attack that has existed since the 1990s. While databases storing training data can certainly be targeted by SQL injection, the attack vector and defense (parameterized queries) are identical to traditional application security. This is not ML-specific.
Option C describes man-in-the-middle (MITM) attacks, another classical network security threat. TLS encryption and certificate pinning defend against MITM regardless of whether the API serves ML model predictions or any other data. No ML-specific defense is needed beyond standard transport security.
Option D describes denial-of-service (DoS) attacks. Rate limiting, auto-scaling, and WAF rules defend against DoS attacks on ML serving infrastructure the same way they defend any API endpoint. The fact that the endpoint returns model predictions rather than database records does not create a unique threat vector.
Additional ML-unique attack vectors that the CISO framework should address include: adversarial examples (crafted inputs that cause model misclassification), model inversion (reconstructing training data from model outputs), membership inference (determining whether a specific record was in the training set), and model stealing (reconstructing model parameters through repeated queries). A comprehensive AI cybersecurity framework for financial services should address all of these in addition to traditional application security controls.