AI Attack Taxonomies and Classification Models COASP Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A security team is classifying vulnerabilities for a recommendation model. The team identifies three issues: (1) the model can be manipulated to recommend harmful products, (2) the model's training data can be inferred through queries, and (3) the model's API exposes internal error messages. Which categorization correctly distinguishes the AI-specific vulnerabilities from the general security issue?

   • AAll three issues are AI-specific vulnerabilities in the model component
   • BIssues 1 and 3 are AI-specific vulnerabilities; issue 2 is a general security issue
   • CAll three issues are general security vulnerabilities that happen to affect an AI system
   • DIssues 1 and 2 are AI-specific vulnerabilities in the model and data components; issue 3 is a general infrastructure vulnerability
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   An offensive AI specialist is planning an attack on a self-driving car's object detection system. The goal is to cause the car to fail to detect a stop sign. The specialist has access to the car's hardware and can install a malicious update to the perception module. However, the update must be signed by the manufacturer to be accepted. Which combination of attack lifecycle stages and attack types best describes the most viable path to achieve the goal?

   • ADelivery (physical access) and Installation (running the update)
   • BCommand and Control (establishing a C2 channel) and Actions on Objectives (exfiltrating data)
   • CReconnaissance (scanning the network) and Delivery (phishing the manufacturer)
   • DWeaponization (crafting a physical adversarial patch) and Exploitation (installing the signed malicious update)
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A red team is planning an attack on a voice-assistant model. The team's objective is to make the model execute a specific command without the user's knowledge. The team has access to the model's API but cannot modify the model or its training data. Which attack strategy is most likely to achieve the objective, and which lifecycle stage does it primarily represent?

   • APoison the training data with the target command, representing the delivery stage
   • BPerform an inference attack to reveal the model's training data, representing the exploitation stage
   • CExtract the model to find a universal bypass, representing the reconnaissance stage
   • DCraft a hidden audio command that the model interprets as the target command, representing the weaponization stage
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A red team is conducting an assessment of an AI-powered malware detection system. The team has successfully identified a vulnerability in the system's feature extraction pipeline that allows them to craft malware samples that are misclassified as benign. The team's ultimate goal is to maintain persistent access to the system's network. Which attack lifecycle stage is the team currently in, and what is the most appropriate next step according to the kill chain?

   • AExploitation; the next step is to establish command and control (C2) to maintain access
   • BActions on Objectives; the next step is to exfiltrate data
   • CWeaponization; the next step is to deliver the malware to the target
   • DDelivery; the next step is to install the malware on the target
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   An offensive AI team is testing a recommendation model that is hosted behind an API with rate limiting. The team wants to determine if the model is vulnerable to extraction, but the rate limit severely restricts the number of queries they can make. Which approach best balances the need to test extraction with the rate-limit constraint?

   • AAssume the model is not vulnerable to extraction because the rate limit prevents it
   • BAbandon extraction testing and focus on evasion attacks, which do not require many queries
   • CUse a small, targeted set of queries designed to maximize information gain about the model's decision boundary, then analyze the results
   • DAttempt to bypass the rate limit by rotating IP addresses and API keys
   Reveal Solution Discussion Select an answer first