Model Privacy Attacks COASP Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A security team has run both a membership inference attack and an attribute inference attack against the same model. The membership inference attack achieves an AUC of 0.85, while the attribute inference attack achieves an accuracy of 70% (base rate 50%). Which conclusion is most justified?

   • ABoth attacks are equally severe because they both exceed 50%
   • BThe membership inference attack is more severe because AUC is always a better metric than accuracy
   • CThe attribute inference attack is more severe because accuracy is always a better metric than AUC
   • DBoth attacks indicate significant privacy leakage, but they measure different aspects and cannot be directly compared without a common metric
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the main goal of a model extraction attack?

   • ATo create a functionally equivalent copy of the target model by querying it
   • BTo infer sensitive attributes of training data
   • CTo determine if a specific record was in the training set
   • DTo reconstruct the exact training images
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A social media company trained a model to predict user engagement from public profile data. The model's predictions are used to recommend content. A researcher demonstrates that by querying the model with synthetic profiles, they can infer a user's private political affiliation, which was not directly used as an input feature. The company wants to mitigate this leakage while preserving the model's recommendation quality. Which defense is most appropriate?

   • AAdd a regularization term that penalizes large model weights
   • BApply differential privacy during training with a modest privacy budget
   • CRemove the political affiliation field from the training data
   • DRestrict API access to authenticated users only
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A bank trains a model to predict loan default from transaction history. The model is used internally. A security analyst wants to evaluate the risk of attribute inference, specifically whether an attacker could infer a customer's salary from the model's predictions. Which approach best evaluates this risk?

   • AUse the model's predictions on synthetic profiles with varying transaction patterns and see if the predictions correlate with salary
   • BCount the number of features in the model
   • CMeasure the model's accuracy on a test set of real customers
   • DCheck if the model's training data includes salary information
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company has deployed a model as a public API. They have implemented a defense that returns only the top-1 class label and limits each user to 1,000 queries per day. An attacker still manages to extract a model with 95% agreement on a test set. Which additional defense would be most effective in reducing extraction fidelity?

   • AReturn the full confidence scores instead of top-1 label
   • BUse a larger neural network
   • CIncrease the query limit to 10,000 per day
   • DAdd differential privacy noise to the model's training process
   Reveal Solution Discussion Select an answer first