FGSM and PGD Attacks on Image Classifiers COASP Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A security team compares FGSM and PGD on a medical image classifier. They find that FGSM has a success rate of 60% and PGD has a success rate of 95% at the same epsilon. They need to report the robustness of the model. What is the most appropriate conclusion?

   • APGD is not a valid attack because it uses too many iterations
   • BThe model is more robust to FGSM than to PGD, but PGD provides a stronger adversarial threat model
   • CFGSM is not a valid attack because it has a lower success rate
   • DThe model is completely robust to adversarial attacks
   Reveal Solution Discussion Select an answer first
2. 22expert · medium

   A security team is comparing the robustness of two classifiers. They run FGSM and PGD on both. Classifier A has a higher clean accuracy, but Classifier B has a lower PGD success rate. What can be concluded?

   • AThe comparison is invalid because FGSM and PGD were used
   • BClassifier A is more robust to PGD attacks
   • CClassifier B is more robust to PGD attacks
   • DClassifier A has higher clean accuracy, so it is more robust overall
   Reveal Solution Discussion Select an answer first
4. 23application · easy

   A data scientist is creating a report to show the impact of adversarial attacks. They generate adversarial examples using FGSM and want to display the perturbation. Which method is most effective?

   • AShow a histogram of the model's weights
   • BShow the model's confidence scores before and after
   • CShow the original image, the adversarial image, and the amplified difference
   • DShow only the adversarial image
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security analyst is evaluating a classifier's robustness. They run FGSM and PGD with the same epsilon on the same test set. PGD achieves a success rate of 95%, while FGSM achieves 70%. What does this comparison indicate?

   • AFGSM is a stronger attack than PGD
   • BThe classifier is more robust to PGD than to FGSM
   • CPGD is a stronger attack than FGSM for this classifier
   • DThe epsilon values were different
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A red team is evaluating a model's robustness and wants to use PGD to find the strongest possible adversarial example. They have a limited compute budget and need to choose between many iterations with a small step size or fewer iterations with a larger step size. What is the best approach?

   • AUse 100 iterations with a step size of epsilon/100
   • BUse 5 iterations with a step size of epsilon/2
   • CUse 1 iteration with a step size of epsilon
   • DUse a moderate number of iterations (e.g., 20) with a step size of epsilon/20
   Reveal Solution Discussion Select an answer first