Training Data Poisoning COASP Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the primary goal of a training data poisoning attack?

   • ATo intercept the model's predictions during inference and modify them in real time
   • BTo overload the training infrastructure with excessive requests to cause a denial of service
   • CTo alter the model's learned behavior by introducing malicious samples into its training set
   • DTo steal the model's weights by querying it with carefully crafted inputs
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A security team trains a phishing detection model on email data. An attacker poisons the training data by embedding a specific URL pattern in a subset of phishing emails and labeling them as benign. The model fails to detect phishing emails containing this URL pattern but performs well on other phishing emails. The team must decide between two defenses: filtering out emails with the URL pattern or retraining the model with a cleaned dataset. Which defense is more effective?

   • ARetrain the model with a cleaned dataset that excludes the poisoned emails and verify the model no longer misclassifies emails with the URL pattern
   • BFilter out emails with the URL pattern at inference time to prevent the model from processing them
   • CAdd more benign emails with the URL pattern to the training data to teach the model that the pattern is benign
   • DUse a simpler model architecture that is less likely to learn the backdoor pattern
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   A backdoor poisoning attack embeds a specific trigger pattern in training samples. What is the effect on the trained model?

   • AThe model outputs random predictions for every input
   • BThe model misclassifies inputs that contain the trigger pattern, while behaving normally on clean inputs
   • CThe model refuses to make predictions on any input containing the trigger
   • DThe model's accuracy degrades uniformly on all inputs
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company trains a recommendation model using user interaction logs collected from its website. An attacker exploits a vulnerability in the website's feedback form to submit thousands of fake user interactions, causing the model to recommend competitor products. Which attack vector and technique combination is being used?

   • ADirect pipeline access via data injection, where the attacker submits fabricated interactions through the feedback form
   • BModel inversion via backdoor insertion, where the attacker embeds a trigger in the interaction logs
   • CAPI poisoning via data injection, where the attacker exploits the model's inference API
   • DSupply chain compromise via label flipping, where the attacker compromises the data storage system
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security team is evaluating the risk of a backdoor poisoning attack on their image-classification model used for access control. The model is trained on a large public dataset of employee photos. An attacker has already inserted a small number of images that all contain a specific watermark in the corner and are labeled as 'authorized'. After deployment, what is the MOST LIKELY observable effect?

   • AThe model will become unable to recognize any employee without the watermark.
   • BThe model's overall accuracy on clean images will drop significantly, causing many false rejections.
   • CThe model will classify any image containing that watermark as 'authorized', even if the person is not an employee.
   • DThe model will start rejecting all images that do not contain the watermark.
   Reveal Solution Discussion Select an answer first