AI Attack Taxonomies and Classification Models COASP Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A red team is planning an attack on a medical diagnosis model. The team has two objectives: (1) cause the model to misdiagnose a specific condition, and (2) remain undetected by the model's monitoring system. The team has access to the model's training data but cannot modify the deployed model directly. Which attack strategy best balances both objectives?

   • AExtract the model and publish it publicly to embarrass the organization
   • BPoison the training data with carefully crafted samples that cause misdiagnosis only for specific inputs, minimizing the chance of detection
   • CConduct an inference attack to reveal patient data, which will indirectly cause misdiagnosis
   • DPerform a broad evasion attack on all inputs to cause widespread misdiagnosis
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A red team is assessing an AI-based content moderation system. The team has a limited number of API queries per day. They have already identified that the system uses a transformer-based model. The team's objective is to cause the system to allow prohibited content (e.g., hate speech) to pass through. Which attack lifecycle strategy is most effective given the query limit?

   • AFocus on model extraction to steal the model, then use it for other attacks
   • BPerform extensive black-box probing to map the model's decision boundary and craft a precise attack
   • CUse a surrogate model to craft transferable adversarial examples, then test them against the target API
   • DAttempt to poison the model by submitting malicious content as training data
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A red team is tasked with assessing an AI-based fraud detection system. The team has limited time and must prioritize attacks that are most likely to succeed and have the highest impact. They have identified that the system uses a publicly available pre-trained model and a proprietary fine-tuning dataset. The team has no direct access to the model's inference API, but they have access to the system's documentation and some sample outputs. Which attack taxonomy-based approach should the team prioritize?

   • APrioritize model extraction via a surrogate model, then use it to craft evasion attacks
   • BPrioritize a brute-force attack on the model's decision boundary using random inputs
   • CPrioritize membership inference attacks to exfiltrate the proprietary fine-tuning data
   • DPrioritize direct data poisoning by injecting malicious samples into the proprietary dataset
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security researcher is evaluating a facial recognition system used for physical access control. The researcher discovers that by wearing a specially crafted pair of glasses, an authorized user can be misidentified as a different, higher-privileged employee. The glasses were designed offline using a surrogate model of the target system. Which attack category and lifecycle stage does this scenario primarily represent?

   • AEvasion attack during the exploitation phase
   • BExtraction attack during the reconnaissance phase
   • CInference attack during the impact phase
   • DPoisoning attack during the delivery phase
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security analyst is classifying a vulnerability in an AI system where an attacker can cause the model to output a different classification by adding a small, imperceptible perturbation to the input image. The perturbation is not random; it is specifically calculated to maximize the model's error. Which vulnerability category and attack type does this represent?

   • AInference vulnerability; evasion attack
   • BData vulnerability; poisoning attack
   • CModel vulnerability; inference attack
   • DModel vulnerability; extraction attack
   Reveal Solution Discussion Select an answer first