An organization is using Microsoft Counterfit to assess the security of an image recognition AI model before production deployment. The security team wants to evaluate the model's resilience to black-box adversarial attacks—where the attacker can only query the model and observe outputs, without access to model weights or architecture. Which Counterfit attack configuration represents a black-box attack?

C is correct because black-box adversarial attacks operate under the assumption that the attacker cannot access model internals—only the API for submitting inputs and receiving predictions. Attacks like ZOO (Zeroth Order Optimization) and boundary attacks craft adversarial examples by systematically querying the model and estimating decision boundaries from outputs alone. Microsoft Counterfit supports these attack algorithms and can assess how resilient the model is to real-world attackers who only have inference access. A is wrong because FGSM (Fast Gradient Sign Method) is a white-box attack that requires access to model gradients (computed via backpropagation through the model), which is not available in a black-box scenario. B is wrong because a gray-box attack uses partial knowledge (like model architecture) that would not be available in a pure black-box evaluation. D is wrong because a transfer attack uses a surrogate model to craft adversarial examples and then transfers them to the target model—this requires training data and represents a different threat model.