Data and Training Pipeline Attacks COASP Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A team is training a medical diagnosis model and is concerned about label poisoning from a data labeling service. They want a defense that can identify and remove mislabeled samples before training. Which technique is most appropriate?

   • AUse robust aggregation to combine multiple models trained on different subsets of the data.
   • BIncrease the model's capacity to learn the correct patterns despite the mislabeled samples.
   • CApply differential privacy to the training data, which will remove all mislabeled samples.
   • DUse a data sanitization approach that flags samples whose features are inconsistent with their labels.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A team maintains a spam filter for an email provider. An attacker floods the training dataset with millions of randomly corrupted emails that have no consistent pattern, causing the model to become nearly unusable and require retraining. Which type of poisoning attack is this, and what is its primary impact?

   • AIntegrity poisoning; the model misclassifies specific targeted emails
   • BAvailability poisoning; the model's overall performance degrades significantly
   • CBackdoor poisoning; the model fails only when a trigger is present
   • DLabel flipping; the model's accuracy on spam detection drops
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which attack scenario best illustrates label flipping?

   • AAn attacker changes the label of a spam email from 'spam' to 'not spam' in the training set
   • BAn attacker deletes all images of a certain class from the training set
   • CAn attacker adds a small white square to images of cats and labels them as dogs
   • DAn attacker modifies the pixel values of an image to make it look like another class
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company is fine-tuning a large language model to act as a customer-support agent. The fine-tuning dataset contains conversation transcripts where a malicious actor has inserted examples that reward the model for providing refunds to customers who mention a specific product code. After deployment, the agent frequently issues refunds when that product code appears, even in inappropriate contexts. Which attack and impact best describe this scenario?

   • AAvailability poisoning during reinforcement learning, causing the agent to become unresponsive.
   • BLabel flipping during data cleaning, where the attacker changed the sentiment labels of conversations.
   • CBackdoor poisoning during inference, where the product code is a trigger embedded at runtime.
   • DData poisoning during fine-tuning, causing an integrity compromise that manipulates the agent's behavior.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A facial recognition system used for physical access control is trained on images of employees. An attacker who can submit a small number of training images adds photos of themselves wearing a specific pair of glasses. After deployment, the system incorrectly grants access to the attacker only when they wear those same glasses. Which attack technique best describes this outcome?

   • AModel inversion attack on the training set
   • BAvailability poisoning via data corruption
   • CLabel flipping on the attacker's images
   • DBackdoor poisoning with a trigger pattern
   Reveal Solution Discussion Select an answer first