Model Extraction and Theft COASP Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   An attacker is extracting a model that returns confidence scores, but the API adds random noise to the scores before returning them. The attacker wants to train a substitute model. Which approach is most likely to overcome the noise and produce a high-fidelity substitute?

   • AUse only the class label derived from the noisy score
   • BUse a substitute model with a very large capacity to memorize the noisy outputs
   • CSend inputs that are far from the decision boundary
   • DQuery the same input multiple times and average the noisy scores
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is a significant business impact of model extraction attacks?

   • ALoss of the model's competitive advantage because competitors can replicate its functionality
   • BImmediate deletion of the original model from the cloud
   • CPermanent corruption of the model's training data
   • DAutomatic revocation of the model's API access for all users
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   An attacker is extracting a model that returns confidence scores. The attacker has a limited query budget and wants to maximize the fidelity of the substitute model. The attacker also knows that the target model is a deep neural network with a smooth decision boundary. Which strategy is most effective?

   • AQuery inputs that are known to be adversarial examples for the target model
   • BQuery a random sample of inputs from the training data distribution
   • CUse a gradient-based optimization to find inputs that maximize the substitute model's uncertainty and query those inputs
   • DQuery inputs that are far from the decision boundary to get high-confidence predictions
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the primary purpose of watermarking a machine learning model?

   • ATo increase the model's accuracy on the training data
   • BTo prevent attackers from querying the model
   • CTo embed a unique identifier that can prove ownership if the model is stolen
   • DTo reduce the model's inference latency
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security researcher is testing the extractability of a company's NLP model. The API returns the full probability vector for each input. The researcher wants to train a substitute model that closely mimics the target. Which query strategy is most effective for this task?

   • AUse the probability vector as soft labels and train the substitute on those outputs
   • BQuery with only the training data from the original model
   • CUse only the top-1 predicted class as a hard label
   • DQuery with random noise and ignore the outputs
   Reveal Solution Discussion Select an answer first