Model Privacy Attacks COASP Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A security team has evaluated a membership inference attack against a model. They report a precision of 0.90 and a recall of 0.60. The model's training set contains 10,000 records, and the attack was tested on a balanced set of 2,000 members and 2,000 non-members. What is the most accurate interpretation of these results?

   • AThe attack has high recall and low precision, meaning it flags too many non-members
   • BThe attack is both highly precise and highly sensitive, so it poses a severe privacy risk
   • CThe attack is highly precise but misses many true members, indicating a conservative attack that may be acceptable if false positives are costly
   • DThe attack's precision and recall are both low, indicating it is ineffective
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security team is comparing two membership inference attacks against their model. Attack A achieves 85% attack success rate, while Attack B achieves 70% attack success rate but with a lower false positive rate. Which statement is correct?

   • AAttack B is always better because it has a lower false positive rate
   • BThe two attacks cannot be compared because they use different metrics
   • CAttack A is more successful overall, but Attack B may be more precise in its positive predictions
   • DAttack A is always better because it has a higher success rate
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   In a model inversion attack, what is the attacker's primary goal?

   • ATo steal the exact model parameters by querying the model
   • BTo infer a sensitive attribute of a known individual from the model's output
   • CTo reconstruct approximate versions of the training data by exploiting the model's outputs
   • DTo determine whether a specific record was included in the training dataset
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security team has run a membership inference attack against a model. They report that the attack correctly identified 80% of the records that were actually in the training set. Which metric does this 80% value represent?

   • AAttack success rate
   • BPrivacy loss
   • CRecall
   • DPrecision
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A company has a model that is vulnerable to both model inversion and membership inference attacks. They are considering two defenses: (1) adding noise to the output scores, and (2) training with differential privacy. Which statement best describes the trade-off between these defenses?

   • ABoth defenses are equally effective and have the same impact on accuracy
   • BDifferential privacy is always better because it has no impact on model accuracy
   • COutput perturbation directly reduces inversion risk but may not address overfitting that drives membership inference; differential privacy reduces both but can significantly reduce model accuracy
   • DOutput perturbation is always better because it provides a formal privacy guarantee
   Reveal Solution Discussion Select an answer first