A fintech lender uses a deep learning model to detect fraudulent loan applications in real time. The security team discovers that sophisticated fraudsters are submitting applications with minute, carefully calculated perturbations to input fields (e.g., small changes in declared income values, address formatting, and device metadata) that cause the fraud model to classify fraudulent applications as legitimate. Which adversarial ML attack type does this scenario describe, and what is the MOST effective primary defense?

The scenario describes an adversarial example attack (also called evasion attack at inference time). In this attack type, an adversary does not modify the model or training data — instead, they craft inputs during inference that exploit the model's learned decision boundary. For ML models that use gradient-based optimization, decision boundaries are often highly sensitive to small perturbations in input space, and adversaries can use gradient information (white-box attack) or iterative probing (black-box attack) to find perturbations that reliably cause misclassification.

In the fintech fraud context described, fraudsters have discovered through trial and error (a black-box attack) which input combinations evade the fraud model. This is consistent with how sophisticated fraud rings operate: they test applications methodically, observe outcomes, and iteratively refine their submissions until they find the evasion boundary.

Adversarial training (Option B) is the most effective primary defense. It involves generating adversarial examples using attack algorithms (e.g., FGSM, PGD, AutoAttack), labeling them with their true classes, and including them in the model's training dataset. Models trained with adversarial examples develop more robust decision boundaries that are less sensitive to small perturbations. This approach is supported by extensive empirical research (Madry et al., Goodfellow et al.) and is considered the gold standard for adversarial robustness.

Option A describes a model inversion attack, where an adversary uses repeated queries to the model to reconstruct properties of the training data (e.g., inferring sensitive attributes of individuals in the training set). Encryption of model outputs can slow this but is not the primary defense described. More importantly, the scenario does not match model inversion — the fraudsters are evading detection, not extracting training data.

Option C describes model stealing, where an adversary uses API queries to reconstruct the model's parameters or a functional equivalent. Rate limiting is a relevant defense for model stealing, but the scenario describes crafted inputs causing misclassification, not parameter extraction.

Option D describes data poisoning, which occurs during training when an adversary injects malicious examples to corrupt model behavior. The scenario explicitly involves attacks at inference time (live application submissions), not training time. Data provenance controls are the correct defense for poisoning but are irrelevant here.

Additional defenses worth layering include: input validation and anomaly detection on application data (detecting statistically unusual input patterns), ensemble methods (harder to find perturbations that fool all models simultaneously), and behavioral analytics (detecting the pattern of repeated near-identical application submissions characteristic of evasion probing).