Data and Training Pipeline Attacks COASP Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the primary difference between availability and integrity poisoning attacks?

   • AAvailability attacks are always more severe than integrity attacks
   • BAvailability attacks only affect the training phase, while integrity attacks only affect the inference phase
   • CAvailability attacks steal data, while integrity attacks delete data
   • DAvailability attacks reduce the model's performance or usability, while integrity attacks cause targeted misclassification or backdoors
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A company is training a sentiment analysis model for customer reviews. An attacker gains access to the labeling process and changes the labels of a small subset of negative reviews to 'positive'. The model later fails to detect negative sentiment in some reviews. Which attack and impact best describe this scenario?

   • AData augmentation attack, where the attacker added noise to the reviews.
   • BLabel flipping, causing an integrity compromise that reduces the model's ability to detect negative sentiment.
   • CAvailability poisoning, causing the model to become unavailable.
   • DBackdoor poisoning, where the attacker embedded a trigger in the reviews.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A team is building an image classifier and uses an automated data augmentation pipeline that flips, rotates, and crops images. An attacker discovers that the augmentation library has a vulnerability that allows them to inject a small number of malicious images that, after augmentation, contain a subtle watermark. The model later misclassifies any image with that watermark. Which pipeline stage was exploited, and what is the best defense?

   • AThe storage stage was exploited; the best defense is to encrypt the training data at rest.
   • BThe collection stage was exploited; the best defense is to use a more secure data source.
   • CThe labeling stage was exploited; the best defense is to use multiple labelers for each image.
   • DThe augmentation stage was exploited; the best defense is to validate and sanitize augmented outputs before they enter the training set.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   How can a backdoor be introduced through data poisoning?

   • ABy adding a specific pattern to a subset of training samples and labeling them with the target class
   • BBy encrypting the training data so the model cannot learn correctly
   • CBy deleting a random portion of the training data to reduce accuracy
   • DBy altering the model's activation functions during training
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company uses an AI model to approve loan applications. An attacker poisons the training data by adding a large number of fake applications with high credit scores, causing the model to approve almost all applications, including high-risk ones. The company suffers financial losses. Which type of poisoning attack and impact does this describe?

   • AAvailability poisoning, because the model becomes unavailable due to the corrupted data.
   • BBackdoor poisoning, because the attacker embedded a trigger in the fake applications.
   • CLabel flipping, because the attacker changed the labels of existing applications.
   • DIntegrity poisoning, because the model's decisions are compromised for a specific class (approvals).
   Reveal Solution Discussion Select an answer first