A security analyst is testing a classifier that uses input normalization (e.g., scaling pixels to [0,1]). They run an FGSM attack with epsilon=0.3 and find that the adversarial image has pixel values outside the valid range. What is the most likely cause and the best fix?

The model expects inputs in [-1,1]; rescale the image to that range

The perturbation was not clipped to the valid input range; clip the adversarial image to [0,1] after adding the perturbation

The epsilon is too small; increase epsilon to 1.0

The gradient is computed incorrectly; use the raw gradient instead of the sign

In a deep learning framework, what is the typical way to ensure that gradients are computed with respect to the input image during an adversarial attack?

Convert the input image to a NumPy array

Use a special loss function designed for adversarial attacks

Set the model's parameters to requires_grad=False

Set requires_grad=True on the input tensor

In a Projected Gradient Descent (PGD) attack, what is the role of the step size parameter (often denoted as alpha)?

It determines the total number of iterations the attack runs

It sets the maximum allowed perturbation for the entire attack

It determines the magnitude of each gradient update step

It controls the randomness of the initial perturbation

A developer is implementing FGSM in TensorFlow. They notice that the attack only works when the model is in training mode (dropout active). When they switch to inference mode, the attack fails. What is the most likely cause?

The input image is normalized differently in training mode

The loss function is different in training mode

The model's weights are different in training mode

The gradient is computed with respect to the loss, but the model's stochastic behavior in training mode provides a different gradient direction

When reporting the success rate of a PGD attack, what additional information is important to include for reproducibility?

The color scheme used in the visualization plots

The number of layers in the classifier

The brand of GPU used for the attack

The values of epsilon, step size, and number of iterations

EC-CouncilCertified Offensive AI Security Professional

Domain 4Objective 2

FGSM and PGD Attacks on Image Classifiers COASP Practice Questions (Page 6)

Part of the Adversarial Machine Learning and Model Privacy Attacks domain, which makes up ~13% of our current practice bank.

35questions here

7free pages

6concepts

Questions 26–30

26expert · hard
A security analyst is testing a classifier that uses input normalization (e.g., scaling pixels to [0,1]). They run an FGSM attack with epsilon=0.3 and find that the adversarial image has pixel values outside the valid range. What is the most likely cause and the best fix?
Select an answer first
27foundation · easy
In a deep learning framework, what is the typical way to ensure that gradients are computed with respect to the input image during an adversarial attack?
Select an answer first
28foundation · easy
In a Projected Gradient Descent (PGD) attack, what is the role of the step size parameter (often denoted as alpha)?
Select an answer first
29expert · hard
A developer is implementing FGSM in TensorFlow. They notice that the attack only works when the model is in training mode (dropout active). When they switch to inference mode, the attack fails. What is the most likely cause?
Select an answer first
30foundation · easy
When reporting the success rate of a PGD attack, what additional information is important to include for reproducibility?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to COASP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “COASP” is a trademark of its owner, used for identification only.