FGSM and PGD Attacks on Image Classifiers COASP Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A red-team analyst is running a PGD attack on an image classifier. They set epsilon=0.3, iterations=40, and step size=0.01. After the attack, they notice the adversarial images are clearly distorted. They want to reduce visibility while maintaining a high attack success rate. Which parameter change is most appropriate?

   • AIncrease iterations to 100
   • BIncrease step size to 0.05
   • CReduce iterations to 10
   • DReduce epsilon to 0.1 and keep iterations at 40
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A researcher is running a PGD attack with epsilon=0.1, iterations=50, and step size=0.01. The attack success rate is 80%. They increase iterations to 200 and the success rate drops to 75%. What is the most likely explanation?

   • AThe epsilon bound was exceeded
   • BThe attack overshoots and oscillates, leading to a less effective final perturbation
   • CThe model became more robust during the attack
   • DThe step size was too large
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A data scientist is visualizing adversarial examples and wants to compare the perturbation patterns of FGSM and PGD at the same epsilon. They notice that the PGD perturbation appears more structured and concentrated on certain regions, while the FGSM perturbation is more uniform. What is the most likely reason?

   • AFGSM perturbs the image in the opposite direction
   • BPGD adds random noise to the perturbation
   • CPGD uses a larger epsilon than FGSM
   • DPGD iteratively refines the perturbation, focusing on the most influential pixels, while FGSM applies a uniform step based on the gradient sign
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security analyst is explaining FGSM to a colleague. They state that FGSM uses the sign of the gradient rather than the gradient magnitude. Why is the sign used?

   • ATo make the attack work on non-differentiable models
   • BTo ensure the perturbation is always positive
   • CTo speed up gradient computation
   • DTo create a perturbation with a fixed magnitude for every pixel, controlled by epsilon
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   In Projected Gradient Descent (PGD), what does the 'projection' step accomplish after each gradient step?

   • AIt projects the gradient onto the tangent space of the image manifold
   • BIt projects the image into a lower-dimensional space to reduce computation
   • CIt projects the image onto the decision boundary of the classifier
   • DIt projects the perturbed image back into the epsilon-ball around the original image
   Reveal Solution Discussion Select an answer first