Model Extraction and Theft COASP Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   An attacker is extracting a model that returns the full probability vector. The attacker wants to minimize the number of queries while achieving high fidelity. Which approach is most effective?

   • AUse only the top-1 class and ignore the probabilities
   • BUse the probability vectors as soft labels and train a substitute model with a loss function that matches the target's outputs
   • CSend random queries and use the outputs to train a generative model
   • DConvert the probability vectors to hard labels and train a classifier
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following is an example of an API-based model extraction attack?

   • AMonitoring electromagnetic emissions from the server running the model
   • BIntercepting network traffic between the model server and its database
   • CSending a large number of queries to the model's inference endpoint and using the responses to train a substitute model
   • DPhysically removing the storage device from the server to copy the model files
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company suspects that a competitor has stolen its proprietary recommendation model. The company wants to prove that the competitor's model is a copy. Which approach is most likely to provide evidence of model theft?

   • AMonitor the competitor's API for unusual query patterns
   • BCheck the competitor's model response time to estimate its architecture
   • CEmbed a unique watermark in the model and later query the competitor's model with watermark-triggering inputs
   • DCompare the competitor's model accuracy on a public benchmark
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A company has deployed a model as a public API and wants to detect model extraction attempts. They have implemented rate limiting and output perturbation. They now want to add a detection mechanism. Which approach is most effective for detecting extraction attempts?

   • AMonitor for an increase in the number of support tickets
   • BMonitor for a decrease in the model's overall accuracy
   • CMonitor for high query volumes from a single client with inputs clustered near decision boundaries
   • DMonitor for an increase in the number of unique users
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   An attacker is extracting a model that returns only the top-1 class label. The attacker has a limited query budget of 10,000 requests. The model has 100 input features. Which strategy is most likely to produce a substitute model with the highest fidelity within the budget?

   • AQuery random points from a uniform distribution over the input space
   • BUse a generative model to synthesize inputs that are near the decision boundary and query the target with those inputs
   • CQuery a fixed grid of points spaced evenly across each feature
   • DQuery the same set of points multiple times to reduce label noise
   Reveal Solution Discussion Select an answer first