Which AI security by design option BEST mitigates targeted model poisoning and supply chain tampering?

Model poisoning attacks target the training data or model parameters to degrade performance or introduce malicious behavior. Supply chain tampering introduces compromised components at vendor or integration stages. Security by design principles require embedding defenses against these threats from the earliest design stages. Why C is Correct: According to ISACA AAIR security by design guidance, adversarial resilience and data integrity controls address both model poisoning and supply chain tampering at their root. Adversarial resilience training prepares the model to resist maliciously crafted inputs. Data integrity controls—cryptographic signing, provenance tracking, integrity verification—detect tampering in training data and model artifacts across the supply chain. Together, these form the most comprehensive defense against both attack categories. Why A is Wrong: Data refreshes with checksums detect post-hoc data corruption but do not build adversarial resilience into the model itself. Checksums verify file integrity but cannot prevent poisoning attacks that maintain file integrity while altering data content. Why B is Wrong: Frequent retraining and bias monitoring address performance drift and fairness but do not specifically protect against deliberate tampering. A retrained model may still be trained on poisoned data if integrity controls are absent. Why D is Wrong: Data tokenization protects sensitive field values from unauthorized access (a privacy control) but does not address model poisoning or supply chain tampering, which can occur without accessing or exposing the sensitive field values themselves.