Model Extraction and Stealing Attacks Quiz

Answers and explanations appear as you take the quiz.

1. What is the core idea behind a model extraction attack?
   • Querying the model and training a substitute to imitate its outputs
   • Hacking into the server to copy the weight files directly
   • Bribing an employee to leak the training dataset
   • Overloading the API until it crashes and dumps memory
2. Why does returning full probability vectors make extraction easier than returning only a top-1 label?
   • It encrypts the response, slowing the attacker down
   • It leaks more information per query, so fewer queries are needed
   • It hides the decision boundary entirely
   • It increases server cost so attackers give up
3. Which defensive technique directly reduces information leaked per query?
   • Adding more GPUs to the server
   • Increasing the model's parameter count
   • Returning rounded or top-1-only outputs
   • Publishing the training data openly
4. What did the 2024 production-language-model extraction paper report about GPT-3.5 Turbo?
   • It reconstructs every GPT-3.5 parameter exactly for under $20
   • It obtains the model’s training dataset directly
   • It extracts a complete model checkpoint from the API
   • It recovers the embedding-projection layer; the paper estimates under $2,000 in queries for GPT-3.5 Turbo
5. Why is a stolen substitute model dangerous beyond just lost revenue?
   • It enables offline white-box attacks like crafting adversarial examples
   • It improves the original model's accuracy
   • It automatically deletes the original model
   • It is required to retrain the original
6. In ActiveThief, what does the combined DFAL + K-center query strategy aim to balance?
   • Boundary-proximate informative samples and reduced redundancy among selected samples
   • Exact recovery of all secret model weights and a guaranteed substitute
   • Random sampling only and avoiding all substitute-model predictions
   • Higher API throughput and removal of the query budget
7. What can API rate limits do against a model-extraction attempt?
   • Prove that no substitute model can be trained
   • Remove all information from each permitted prediction
   • Make large-scale querying slower or more expensive
   • Make model outputs impossible to compare
8. What does the DynaMarks paper propose for a model-extraction defense?
   • It adds a logo to every generated answer
   • It encrypts all model weights at rest
   • It guarantees ownership of every copied production model
   • It can embed a signature in a surrogate model by dynamically changing API outputs using secret parameters