Data poisoning attacks involve malicious modification of training data to degrade model performance or introduce backdoors. With multiple external data sources, the attack surface for introducing poisoned data is broad and requires proactive, continuous detection at the ingestion stage.

Why B is Correct: The ISACA AAIR adversarial AI guidance identifies continuous monitoring and anomaly detection at the data ingestion pipeline as the most effective defense against data poisoning. By monitoring incoming data in real time for statistical anomalies, unexpected distributions, or known poisoning patterns, organizations can detect and block malicious data before it contaminates training datasets. This preventive approach is superior to reactive detection after poisoning has occurred.

Why A is Wrong: Reactive data integrity reviews triggered by model drift occur after poisoning has already affected model behavior. By this stage, the model may have been deployed and made harmful decisions. Prevention during ingestion is superior to post-drift investigation.

Why C is Wrong: Model code and deployment artifact controls address security of the software pipeline but do not protect training data from external poisoning. Data integrity requires data-layer controls, not code security.

Why D is Wrong: Regularization reduces overfitting to training noise but does not detect or prevent deliberate poisoning attacks. A sufficiently targeted poisoning attack can introduce systematic bias that regularization techniques cannot mitigate.