Data and Training Pipeline Attacks COASP Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A company runs an AI-based intrusion detection system. An attacker wants to evade detection for a specific type of attack while also causing the system to be less reliable overall. The attacker has access to the training data but can only modify a limited number of samples. Which attack strategy is most effective given the constraint?

   • AUse a combination of backdoor and availability poisoning, but prioritize the backdoor due to limited sample budget
   • BInject a backdoor trigger for the specific attack type
   • CInject a small number of corrupted samples to cause availability poisoning
   • DPerform label flipping on a subset of the specific attack type
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   What is the purpose of robust aggregation in defending against data poisoning?

   • ATo combine model updates from multiple clients in a way that minimizes the influence of malicious updates
   • BTo encrypt the training data so that attackers cannot read it
   • CTo validate the model's performance on a separate test set
   • DTo increase the size of the training dataset by generating synthetic samples
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A robotics company is training an autonomous navigation agent using reinforcement learning. An attacker compromises the simulation environment and alters the reward function so that the agent receives high rewards for stopping at intersections with a specific graffiti pattern. After deployment, the agent stops at every intersection with that pattern, even when it is unsafe. Which attack and impact best describe this scenario?

   • AAvailability poisoning, causing the agent to become unresponsive at all intersections.
   • BBackdoor poisoning of the training data, where the graffiti pattern is a trigger embedded in the environment.
   • CLabel flipping during the data collection stage, where the attacker changed the labels of intersection images.
   • DData poisoning of the reinforcement learning environment, causing an integrity compromise that manipulates the agent's behavior.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A company is training a model on a large dataset that includes data from multiple sources. They suspect that a small portion of the data may be poisoned, but they cannot afford to manually review all samples. Which defense is most appropriate to reduce the impact of poisoning without requiring manual review?

   • AUse a larger learning rate to help the model converge faster and ignore poisoned samples.
   • BUse robust aggregation during training to reduce the influence of outlier samples.
   • CApply differential privacy to the data, which will automatically remove poisoned samples.
   • DIncrease the model's capacity to learn the correct patterns despite the poisoned samples.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A financial institution is training a fraud detection model and is worried about an attacker who can poison a small fraction of the training data. The institution wants a defense that minimizes the impact of poisoned samples on the model's learned parameters. Which technique is most appropriate?

   • AApply differential privacy to the training data, which will remove all poisoned samples.
   • BIncrease the number of training epochs to allow the model to average out the poisoned samples.
   • CUse a larger learning rate to help the model converge faster and ignore poisoned samples.
   • DUse robust aggregation methods, such as median-based or trimmed-mean aggregation, during training.
   Reveal Solution Discussion Select an answer first