Model Extraction and Theft COASP Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security team is assessing the risk of model extraction for a model deployed on a cloud GPU server. They are considering different attack vectors. Which vector is most likely to be used by an external attacker with no physical access?

   • ATiming attack by measuring response times over the network
   • BAPI-based extraction by sending crafted queries to the model's endpoint
   • CHardware side-channel attack by measuring electromagnetic emissions
   • DPower analysis of the GPU during inference
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An attacker is extracting a sentiment-analysis model through a public API. The API returns only the predicted class (positive/negative) and not confidence scores. The attacker wants to approximate the model's decision boundary more efficiently. Which approach should the attacker use?

   • AUse active learning to select the most informative queries
   • BSend random inputs uniformly across the input space
   • CUse a fixed grid of inputs covering the entire feature space
   • DQuery with only the most common phrases in the training data
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company provides a machine-learning API and wants to defend against model extraction. They have three options: (1) add noise to the output probabilities, (2) limit the number of queries per user, and (3) watermark the model. The company also wants to maintain a high-quality API for legitimate users and be able to prove theft in court if it occurs. Which combination of defenses is most balanced?

   • AOnly limit the number of queries per user
   • BImplement output perturbation and query limiting, and also embed a watermark
   • COnly add noise to the output probabilities
   • DOnly watermark the model
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A company has a proprietary model and suspects a competitor has stolen it. The company has a watermark embedded in the model. To confirm the theft, the company queries the competitor's public API with the watermark trigger. The competitor's API returns the expected watermark output. However, the competitor claims the output is a coincidence. Which additional evidence would most strongly support the theft claim?

   • AShow that the competitor's model has a similar response time
   • BShow that the competitor's API documentation is similar to the company's
   • CShow that the watermark trigger is a rare, specially crafted input that produces a unique output only in the original model
   • DShow that the competitor's model has similar accuracy on a public benchmark
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   In a query-based extraction attack, what does the attacker use the collected query-response pairs for?

   • ATo train a substitute model that mimics the target model's outputs
   • BTo directly copy the model's weights from the server
   • CTo reverse-engineer the model's training algorithm and reproduce it
   • DTo generate adversarial examples that cause the target model to fail
   Reveal Solution Discussion Select an answer first