Design a defense-in-depth strategy against adversarial evasion on a deployed image classifier

WHAT THIS TESTS: The interviewer is evaluating whether you view adversarial robustness as a systems-level MLOps problem rather than a single algorithmic patch. They want to see layered thinking that connects model hardening, input sanitization, infrastructure controls, and operational monitoring into a coherent defense architecture.

A GOOD ANSWER COVERS: Proactive training-time measures first. These include adversarial training with methods like PGD or TRADES to improve robustness within an epsilon ball; input preprocessing defenses such as JPEG compression, bit-depth reduction, or spatial smoothing to disrupt gradient-based perturbations; and ensemble strategies or randomized smoothing to increase attacker uncertainty. Second, reactive inference-time controls. These include strict input validation with bounds checking and format constraints; statistical anomaly detection on input distributions, intermediate embeddings, or output logits to catch out-of-distribution or adversarial samples; rate limiting and query throttling to impede iterative attacks and model extraction; graduated response workflows that route suspicious requests to a safer secondary model or human review; and comprehensive logging of predictions and metadata for forensic analysis. Third, infrastructure hardening such as authenticated API gateways, encrypted model artifacts, and runtime isolation.

COMMON WRONG ANSWERS: Claiming that adversarial training alone guarantees safety. Proposing only superficial input checks like resizing or format validation without behavioral monitoring. Ignoring the inference API attack surface and failing to mention rate limiting or authentication. Neglecting incident response and the need for production monitoring. Suggesting security through obscurity or model secrecy as the primary defense.

LIKELY FOLLOW-UPS: How do you trade off clean accuracy against adversarial robustness? What is your approach when attackers adapt to known defenses? How would you handle a confirmed adversarial example in production? Can you quantify the latency and cost impact of ensemble inference at scale?

ONE CONCRETE EXAMPLE: Consider a production image classifier that accepts user uploads. The pipeline begins with JPEG compression and resizing to strip subtle perturbations. A lightweight autoencoder checks reconstruction error; if it is anomalous, the request is flagged. The primary model then produces a prediction. If softmax entropy exceeds historical thresholds or confidence drops abruptly, the request graduates to a secondary ensemble. After three flagged requests from the same API key within one minute, rate limiting activates and alerts fire. All anomalous embeddings and inputs are logged to a SIEM and batched for monthly adversarial retraining.