Model Privacy Attacks COASP Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A facial recognition company trains a model on a private dataset of celebrity photos. They expose a public API that returns the identity label and confidence score for any uploaded image. A security researcher warns that the API could be used to reconstruct realistic faces of individuals not in the public dataset. The company must decide on a defense. Which approach provides the strongest protection while preserving the API's core functionality?

   • AApply differential privacy during training and add noise to the confidence scores before returning them
   • BUse a model with fewer parameters to reduce memorization
   • CAdd a watermark to the output images to deter misuse
   • DReturn only the top-1 label without any confidence score
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A social media company has a model that predicts user engagement. The model uses public features like post content and time of day. A privacy researcher wants to test whether the model's predictions leak a user's political affiliation, which is a private attribute not used as an input. Which metric would best quantify the severity of this leakage?

   • APrecision of the model's engagement predictions
   • BAttack success rate for predicting the private attribute
   • CNumber of training records
   • DModel's accuracy on public features
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security team evaluated a membership inference attack against their model. The attack achieved 90% precision and 40% recall. Which interpretation is correct?

   • AThe attack is 90% accurate overall and 40% of the time it is confident
   • BThe attack has a 90% false positive rate and a 40% false negative rate
   • CThe attack correctly identifies 90% of training members, and 40% of non-members are misclassified as members
   • DWhen the attacker predicts a record is in the training set, they are correct 90% of the time, but they only identify 40% of all actual training members
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   In an attribute inference attack, what information does the attacker typically have about the target record?

   • ASome non-sensitive attributes and the model's prediction for that record
   • BThe exact training data label for the record
   • CThe complete training dataset
   • DThe model's internal weights and gradients
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which factor most directly influences the effectiveness of a membership inference attack?

   • AThe model's overfitting to its training data
   • BThe number of classes in the classification task
   • CThe size of the model's input space
   • DThe choice of activation function in the neural network
   Reveal Solution Discussion Select an answer first