Adversarial examples are often model-specific, meaning that they exploit the specific weaknesses of a particular model. While some adversarial examples might transfer between models, many are tailored to the specific model they were generated for and may not affect other models trained on the same task.

The ISTQB CT-AI syllabus explains in Section3.2 - Functional Performance Criteria of ML Modelsthat accuracy becomes unreliable when class imbalance exists. In fraud detection, more than 99% of transactions are non-fraudulent, meaning the dataset is extremely imbalanced.
Because accuracy counts all correct non-fraudulent classifications, it will appear artificially high, even if the fraud detection performance is poor. Therefore, accuracy is not suitable for evaluating fraud detection systems.
The syllabus further explains that sensitivity (recall)captures the proportion of correctly identified fraudulent cases. This metric is important, as missing fraudulent events can cause high financial loss. However, the client also stresses thatlegitimate transactions must be correctly identified, meaning false positives must be minimized to maintain customer satisfaction.
The F1 score, defined as the harmonic mean of precision and recall, balances both:
Precision protects legitimate customers by minimizing false alarms.
Recall ensures fraudulent transactions are detected.
Section 3.2 emphasizes that when both false positives and false negatives have significant consequences, and the data is highly imbalanced, F1 is the most appropriate metricbecause it reflects the combined importance of detecting fraud while avoiding unnecessary alerts. Thus, Option C is the correct choice.

In black-box adversarial testing, the tester does not have access to the internal workings of the model (such as the algorithm or the training data). The approach relies on the transferability of the attacks, where adversarial examples generated for one model are used to test the robustness of another model, even without direct access to its internal details.

The syllabus states that while pairwise testing is effective at finding defects by reducing the number of test cases needed, the resulting test suite can still be extensive and require automation:
"Even the use of pairwise testing can result in extensive test suites... automation and virtual test environments often become necessary to allow the required tests to be run."

The correct answer is D . The CT-AI syllabus explains that ML systems make decisions and predictions using algorithms and collected data , and that both can introduce bias into the results. Algorithmic bias can occur when the learning algorithm is incorrectly configured, for example where it overvalues some data compared with other data. Sample bias can occur when training data is not fully representative of the data space to which ML is applied. The syllabus further states that inappropriate bias is often caused by sample bias, but can also be caused by algorithmic bias.
Option A is too narrow because it describes only one algorithmic mechanism. Option B is also incomplete because it describes sample bias only. Option C is incorrect because the syllabus states that bias can be introduced into many types of AI-based systems, not only ML systems involving personal data. Therefore, the most complete and syllabus-aligned statement is that inappropriate bias can arise from either the algorithm or the data.
References/topics: CT-AI Syllabus Chapter 2, Section 2.4 "Bias."
=========