FGSM and PGD Attacks on Image Classifiers COASP Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A security team is reporting the attack success rate (ASR) of FGSM and PGD on a classifier. They notice that the ASR varies significantly depending on the random seed used for the test set. What is the most appropriate way to report the ASR to ensure reliability?

   • AReport the ASR from the first run only
   • BReport the ASR from the single run with the lowest success rate
   • CReport the ASR from the single run with the highest success rate
   • DRun the attack on multiple random subsets and report the mean and standard deviation of the ASR
   Reveal Solution Discussion Select an answer first
2. 32expert · medium

   A developer is implementing FGSM in PyTorch. They want to ensure the adversarial image remains within the valid pixel range [0, 1]. Which operation should they apply after adding the perturbation?

   • Atorch.clamp(adv_image, 0, 1)
   • Btorch.normalize(adv_image)
   • Ctorch.abs(adv_image)
   • Dtorch.sigmoid(adv_image)
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A researcher is comparing FGSM and PGD on a classifier. They set the same epsilon for both attacks. PGD achieves a higher success rate. What is the most likely reason?

   • APGD modifies the model's weights
   • BPGD does not require a gradient
   • CPGD iteratively refines the perturbation, finding a stronger adversarial direction within the same epsilon bound
   • DPGD uses a larger epsilon than FGSM
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A security team evaluates the robustness of a facial recognition model. They run FGSM and PGD attacks on a test set of 1,000 images and report the attack success rate (ASR). They observe that PGD achieves a higher ASR than FGSM at the same epsilon. What is the most likely reason?

   • AFGSM is not a valid attack on facial recognition models
   • BPGD perturbs the labels instead of the images
   • CPGD uses multiple iterations, allowing it to find stronger perturbations within the same epsilon-ball
   • DPGD uses a larger epsilon than FGSM
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   In the context of adversarial attacks, what does the epsilon parameter control?

   • AThe confidence threshold for the classifier's predictions
   • BThe maximum allowed perturbation magnitude for each pixel
   • CThe learning rate of the classifier's optimizer
   • DThe number of iterations in an iterative attack
   Reveal Solution Discussion Select an answer first