FGSM and PGD Attacks on Image Classifiers COASP Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A researcher implements PGD and wants to ensure the adversarial image stays within the allowed perturbation budget. After each gradient step, they apply a projection operation. What does this projection do?

   • AIt converts the image to grayscale
   • BIt clips the perturbed image to the epsilon-ball around the original image
   • CIt rounds the pixel values to the nearest integer
   • DIt normalizes the image to have zero mean and unit variance
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   How is the success rate of an adversarial attack typically measured?

   • AThe percentage of adversarial examples that are misclassified by the model
   • BThe difference in loss values between original and adversarial examples
   • CThe average confidence score of the model on adversarial examples
   • DThe number of iterations required to craft each adversarial example
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the primary purpose of using the sign of the gradient in the Fast Gradient Sign Method?

   • ATo ensure the perturbation is small and bounded by the epsilon value
   • BTo ensure the gradient is always positive
   • CTo make the perturbation invisible to the human eye
   • DTo speed up the computation of the gradient
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A red team is evaluating a classifier and wants to maximize attack success while keeping perturbations imperceptible. They are considering using PGD with a large number of iterations and a small step size. What is the primary trade-off they must consider?

   • AMore iterations increase computational cost but may yield stronger perturbations within the epsilon-ball
   • BA smaller step size reduces the attack success rate
   • CMore iterations always lead to overfitting to the training data
   • DA larger epsilon is always better for imperceptibility
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A developer is implementing a PGD attack and wants to ensure the adversarial example is valid (i.e., within the epsilon-ball) after the final iteration. They apply the projection step only at the end of the loop. What is the potential issue?

   • AThe final image will be identical to the original
   • BThe attack will fail because the gradient becomes zero
   • CIntermediate steps may leave the epsilon-ball, leading to a suboptimal final perturbation
   • DThe attack will be slower because projection is applied only at the end
   Reveal Solution Discussion Select an answer first