Model Extraction and Theft COASP Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A company has a model that is critical to its business. The security team is considering two defenses: (1) adding noise to the confidence scores and (2) limiting the number of queries per user. The team has a limited budget and must choose one defense. Which defense is more effective at reducing the fidelity of a substitute model?

   • AAdding noise to confidence scores, because it degrades the quality of every response
   • BLimiting the number of queries per user, because it reduces the total information an attacker can collect
   • CBoth are equally effective because they both reduce information
   • DNeither is effective because extraction is always possible
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security team is evaluating the risk of model extraction for a model deployed on an embedded device in a public location. The device has a network interface and also exposes physical debug ports. Which attack vector is most concerning for an attacker with physical access?

   • AMembership inference using the device's logs
   • BSide-channel attack using power or electromagnetic measurements
   • CModel inversion using the device's output
   • DAPI-based extraction through the network interface
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security analyst is investigating a suspected model theft. The victim model is deployed on a cloud GPU server. The analyst finds that the attacker had physical access to the server room and used a tool to measure electromagnetic emissions from the GPU during inference. Which extraction vector does this evidence indicate?

   • AAPI-based extraction via public endpoints
   • BSocial engineering of the model developer
   • CSupply-chain compromise of training data
   • DHardware-based side-channel extraction
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A financial firm offers a credit-scoring API. They notice a sudden spike in queries from a single IP address, with many queries clustered near the decision threshold. They want to slow down the extraction attempt without blocking legitimate users. Which defense should they implement?

   • AAdd a CAPTCHA to every API request
   • BShut down the API temporarily
   • CReturn random labels for all queries
   • DRate-limit the number of API calls per API key
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the purpose of crafting specific queries in a query-based model extraction attack?

   • ATo overload the model's server and cause a denial of service
   • BTo trick the model into revealing its API keys or authentication tokens
   • CTo obtain informative input-output pairs that help approximate the model's decision boundary
   • DTo discover the model's training data and replicate it exactly
   Reveal Solution Discussion Select an answer first