FGSM and PGD Attacks on Image Classifiers COASP Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   How does Projected Gradient Descent (PGD) differ from the Fast Gradient Sign Method (FGSM) in terms of the number of gradient computations?

   • APGD uses the Hessian matrix, while FGSM uses only the gradient
   • BPGD computes the gradient only once, while FGSM computes it multiple times
   • CPGD uses stochastic gradient descent, while FGSM uses batch gradient descent
   • DPGD performs multiple gradient steps, while FGSM performs only one
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security researcher is testing a deployed image classifier for robustness. They want a quick, single-step adversarial attack that maximizes the chance of misclassification while minimizing computational cost. They plan to use the sign of the gradient. Which epsilon value should they choose to achieve the strongest single-step perturbation without exceeding the allowed perturbation budget?

   • Aepsilon = 0.01
   • Bepsilon = 1.0
   • Cepsilon = 0.3
   • Depsilon = 0.0
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   In the Fast Gradient Sign Method (FGSM), how is the adversarial perturbation computed from the gradient of the loss with respect to the input image?

   • ABy randomly sampling a small noise vector and adding it to the image
   • BBy taking the sign of the gradient and scaling it by a small epsilon
   • CBy normalizing the gradient to unit length and adding it to the image
   • DBy taking the gradient magnitude and adding it directly to the image
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A data scientist generates adversarial examples using FGSM and wants to visually inspect the perturbation. They plot the original image, the adversarial image, and the difference between them. The difference image appears mostly black with faint white edges. What does this indicate?

   • AThe epsilon value was set too high, causing the perturbation to saturate
   • BThe attack failed because the perturbation is not visible
   • CThe model is robust to FGSM because the gradient is zero
   • DThe perturbation is small and localized to high-gradient regions, which is typical for FGSM with a modest epsilon
   Reveal Solution Discussion Select an answer first
6. 15application · easy

   A researcher generates adversarial examples using FGSM with epsilon=0.05 and saves them as PNG files. When they view the images, they look identical to the originals. What is the most likely reason?

   • AThe model's gradients were zero
   • BThe attack failed and no perturbation was added
   • CThe perturbation is too small to be perceived by the human eye
   • DThe images were saved in a lossy format that removed the perturbation
   Reveal Solution Discussion Select an answer first