Model Privacy Attacks COASP Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which method is commonly used in a model extraction attack?

   • AExploiting a buffer overflow in the model server
   • BSending carefully crafted queries to the target model and using the responses to train a substitute model
   • CIntercepting network traffic to steal model weights
   • DPoisoning the training data with malicious samples
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A startup offers a proprietary image classification API. A competitor wants to build a similar model without collecting its own training data. The competitor only has access to the API and can send queries and receive predictions. Which attack would allow the competitor to replicate the API's functionality?

   • AAttribute inference attack
   • BMembership inference attack
   • CModel extraction attack
   • DModel inversion attack
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A company sells a machine-learning model as a software product that runs on customers' local machines. The model is a large neural network with millions of parameters. A competitor purchases the product and extracts the model's parameters directly from the software. The company wants to prevent this type of extraction in future releases. Which approach is most effective?

   • ARely on legal agreements that prohibit reverse engineering
   • BAdd watermarking to the model so that extracted copies can be traced
   • CUse model obfuscation and encrypt the model file, requiring a secure hardware key at runtime
   • DReduce the model's accuracy to make it less valuable to competitors
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A startup offers a machine-learning-based image classification API and charges per prediction. A competitor wants to replicate the model's functionality without access to the training data. They have a large budget for API calls and a public dataset of unlabeled images. Which attack strategy would most effectively achieve their goal?

   • AQuery the API with the public images, collect the predicted labels, and train a substitute model on the input-output pairs
   • BUse the API to perform model inversion and reconstruct the original training images
   • CSend adversarial examples to the API to cause misclassifications and observe the errors
   • DPerform a membership inference attack to determine which public images were in the training set
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A medical imaging model returns a probability score for each possible diagnosis. A researcher wants to demonstrate that the model leaks information about the training images. They plan to use the model's output scores to iteratively optimize a random noise image until the model classifies it as a specific disease. Which attack is the researcher performing?

   • AModel inversion attack
   • BModel extraction attack
   • CAttribute inference attack
   • DMembership inference attack
   Reveal Solution Discussion Select an answer first