Adversarial Machine Learning Techniques COASP Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A company is deploying an AI model for resume screening. They are concerned about candidates manipulating their resumes to get past the filter. Which threat model category does this attack fall under?

   • AEvasion attack at inference time.
   • BModel inversion attack to extract training data.
   • CMembership inference attack to determine if a resume was in training data.
   • DData poisoning attack on the training data.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A healthcare AI system uses a model to classify medical images. The security team is threat-modeling and wants to identify the most likely attack vector that could cause the model to misdiagnose a patient. Which attack vector should they prioritize?

   • AModel extraction
   • BEvasion attack
   • CMembership inference
   • DData poisoning
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security analyst is testing an image classifier used for facial recognition. They want to generate an adversarial example that is imperceptible to humans but causes the model to misidentify a person. Which technique is most appropriate?

   • AGradient clipping
   • BModel pruning
   • CFeature scaling
   • DFast Gradient Sign Method (FGSM)
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A red team is testing a facial recognition system. They have black-box access (only predictions) and want to craft an adversarial example that causes the system to misidentify a person. Which approach is most effective?

   • AUse membership inference to determine if the person is in the training set
   • BUse a substitute model to generate adversarial examples and transfer them
   • CUse model inversion to reconstruct the target's training data
   • DUse FGSM directly on the target model
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security researcher is testing a natural language processing (NLP) model used for sentiment analysis. They want to create an adversarial example that changes the model's output from positive to negative while keeping the text semantically similar. Which approach should they use?

   • AGradient clipping
   • BDifferential privacy
   • CModel pruning
   • DCharacter-level perturbation
   Reveal Solution Discussion Select an answer first