Model Privacy Attacks COASP Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which defensive technique adds calibrated noise to model outputs to protect against privacy attacks?

   • AAdversarial training
   • BOutput perturbation
   • CInput validation
   • DModel quantization
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A social network trains a model to recommend friends. They plan to release the model's embeddings for each user to researchers. A privacy review shows that the embeddings can be used to infer sensitive attributes like age and gender. The company wants to reduce this risk while keeping the embeddings useful for research. Which defense is most appropriate?

   • ARelease only the first 10 dimensions of each embedding
   • BRequire researchers to sign a non-disclosure agreement
   • CAdd noise to the embeddings before releasing them, calibrated to the desired privacy budget
   • DRemove age and gender from the training data
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A government agency trains a model on sensitive citizen data and must publish the model for public use. They are required to limit the risk of membership inference attacks while maintaining reasonable model accuracy. They have decided to use differential privacy. Which configuration best balances privacy and utility?

   • ASet a large epsilon (e.g., 10.0) to preserve high accuracy, since the model is only used for research
   • BUse no differential privacy but add strong L2 regularization to the model
   • CApply output perturbation only at inference time, without modifying training
   • DSet a small epsilon (e.g., 1.0) to provide strong privacy guarantees, accepting a moderate accuracy drop
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which threat model best describes a typical model inversion attack?

   • AAn attacker who can modify the training data
   • BAn attacker with black-box query access to the model's predictions
   • CAn attacker who can alter the model's weights directly
   • DAn attacker who can intercept network traffic between the model and its users
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A security team is evaluating the risk of model inversion on a face recognition model. They have two candidate defenses: (1) adding noise to the output confidence scores, and (2) applying strong L2 regularization during training. The team must choose one defense. What is the most important consideration in this decision?

   • ARegularization is always better because it has no impact on model accuracy
   • BBoth defenses are equally effective against model inversion
   • COutput perturbation directly disrupts the inversion attack's gradient signal, while regularization only indirectly reduces overfitting-related leakage
   • DOutput perturbation is always better because it provides a formal privacy guarantee
   Reveal Solution Discussion Select an answer first