What does the principle 'Trust but Verify' imply in AI security?

• A. AI models must be validated continuously due to their evolution and reliance on potentially unverified data sources.
• B. AI models should only be validated during initial deployment.
• C. Validation is unnecessary for models trained on verified data.
• D. Verification should be outsourced to vendors only.

Answer: (A)

Trust but Verify in AI security means you don’t assume a model is always safe or accurate just because it worked at deployment. AI systems can evolve after deployment as they are retrained on new data or exposed to changing inputs, and those data sources may be imperfect or even manipulated. Because of this, validation must be continuous: ongoing monitoring of performance and behavior, regular testing for accuracy, bias, and robustness, and checks on data provenance and security features. This ongoing scrutiny helps catch drift, data poisoning, or emerging threats early and prompts timely mitigations, keeping the system safe and reliable over its life.

Why this is the best fit: it captures the need for perpetual assessment in light of model evolution and potentially untrusted data sources. The other ideas fall short because relying only on initial validation ignores drift and new risks; assuming validation isn’t needed if data is “verified” ignores that models can behave unexpectedly even with good data; and outsourcing verification to vendors alone ignores internal accountability and the need for continuous, integrated monitoring across the full lifecycle.