A company is implementing a Secure AI Development Lifecycle (SDL) for its AI products. At which phase of the SDL should threat modeling for AI-specific threats (such as prompt injection, training data poisoning, and model inversion) be performed?

C is correct because threat modeling is a design-phase activity in the Secure SDL. Identifying AI-specific threats (prompt injection, data poisoning, model inversion) during the design phase allows architects and developers to incorporate mitigations into the architecture before code is written—reducing the cost and effort of rework. Microsoft's SDL for AI explicitly places threat modeling in the design phase to ensure security is built in, not bolted on. A is wrong because performing threat modeling only in production means security issues are discovered too late, after the system is live and potentially exposed to attackers. B is wrong because post-training testing and evaluation is too late to influence fundamental architectural decisions; threat modeling should inform design choices. D is wrong because while data poisoning concerns are relevant to data collection, threat modeling should encompass all AI lifecycle phases and be completed holistically in the design phase.