An AI deployment pipeline uses automated vulnerability scanning on the model container images before deployment. A security team lead argues this is sufficient security validation for the AI system. What does this approach FAIL to address?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because container security scanning is a deployment infrastructure control that checks for known software vulnerabilities in the container environment. It does not assess AI model-specific risks: it cannot detect whether the model has been backdoored during training, whether it is robust to adversarial inputs, whether its predictions are systematically biased, or whether training data was poisoned.
Full explanation below image
Full Explanation
B is correct because container security scanning is a deployment infrastructure control that checks for known software vulnerabilities in the container environment. It does not assess AI model-specific risks: it cannot detect whether the model has been backdoored during training, whether it is robust to adversarial inputs, whether its predictions are systematically biased, or whether training data was poisoned. AI security requires both infrastructure security (which scanning provides) and AI-specific risk assessment. A mischaracterizes what container scanning can detect. C and D are narrower technical arguments that miss the fundamental point.