Adversarial Example Attacks on ML Models

1. Gradient masking is considered:

A robust defense mechanism

A weak defense that obscures gradients

Only effective against white-box attacks

The strongest adversarial defense

2. Ensemble-based defenses combine multiple models to:

Reduce inference latency

Increase model capacity

Make attacks less transferable

Improve clean accuracy

3. The robustness-accuracy tradeoff describes:

No relationship between robustness and clean accuracy

Improving robustness often reduces clean data accuracy

Robustness and accuracy always improve together

Only adversarial training creates this tradeoff

4. Robust optimization for adversarial training solves:

A single optimization problem

A min-max optimization game

A convex problem

An unconstrained problem

5. An attack with ε = 0.03 in L∞ norm means:

3% change in pixel values

Maximum pixel change of 0.03

Total perturbation budget of 3

3 pixels modified

6. Randomized smoothing improves robustness by:

Adding Gaussian noise to predictions

Ensemble voting on noisy inputs

Removing outliers

Increasing model capacity

7. Certified defenses provide:

Heuristic robustness guarantees

Provable robustness bounds

No robustness guarantees

Only empirical robustness

8. The perturbation budget in adversarial attacks is measured by:

Computational cost

Norm constraints (L2, L∞)

Number of iterations

Training time

9. Evasion attacks occur during:

Model training

Model inference

Data collection

Feature engineering

10. Defensive distillation works by:

Compressing the model

Training a student model on soft targets

Removing model layers

Increasing batch size

11. What is an adversarial example in machine learning?

A training sample mislabeled on purpose

An input deliberately crafted to fool a model

A model with poor accuracy

A dataset with class imbalance

12. Which defense method adds noise to model inputs?

Gradient masking

Input randomization

Distillation

Ensemble methods

13. Transferability in adversarial attacks means:

Attacks work across different model architectures

Attacks only work on specific models

Models can transfer learning

Attacks improve with more data

14. What is the primary goal of adversarial robustness?

Increase model accuracy on clean data

Maintain performance under adversarial attacks

Reduce training time

Improve model interpretability

15. Adversarial training involves:

Training on adversarial examples alongside clean data

Using only adversarial examples

Removing adversarial examples

Training without labels

16. The C&W (Carlini & Wagner) attack is known for:

Being gradient-free

Generating minimal perturbations

Requiring model retraining

Only working on image classifiers

17. Adversarial perturbations are typically:

Large and visually obvious

Small and often imperceptible to humans

Random noise

Structural changes to input

18. What does FGSM stand for?

Fast Gradient Sign Method

Functional Gradient Sensitivity Metric

Feature-based Gradient Search Model

Federated Gradient Security Module

19. In a black-box adversarial attack, the attacker has access to:

Model weights and gradients

Only input-output pairs

Source code but not weights

Training data

20. Which of the following is a white-box attack?

FGSM (Fast Gradient Sign Method)

Random search attack

Zeroth-order optimization attack

Query-only attack

SecAI+ Adversarial Example Attacks on Models Quiz