A company's AI security team is evaluating the risk of adversarial examples—inputs crafted to fool an image classification AI model used for security camera analysis. The team wants to test the model's robustness to adversarial perturbations. Which approach assesses this robustness?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because adversarial robustness testing requires generating adversarial examples—slightly perturbed inputs designed to fool the model—using established attack methods (FGSM, PGD, C&W attacks) implemented in libraries like IBM's Adversarial Robustness Toolbox (ART) or Microsoft's Counterfit. The team measures the model's accuracy on these adversarial inputs to quantify robustness.
Full explanation below image
Full Explanation
B is correct because adversarial robustness testing requires generating adversarial examples—slightly perturbed inputs designed to fool the model—using established attack methods (FGSM, PGD, C&W attacks) implemented in libraries like IBM's Adversarial Robustness Toolbox (ART) or Microsoft's Counterfit. The team measures the model's accuracy on these adversarial inputs to quantify robustness. If accuracy drops significantly, the model needs adversarial training or input preprocessing defenses. A is wrong because static code analysis examines source code for programming vulnerabilities (buffer overflows, injection flaws); it cannot detect a model's susceptibility to adversarial perturbations in input data. C is wrong because increasing training dataset size improves generalization but does not directly address adversarial robustness—a model can be 99% accurate on clean data and still be highly susceptible to adversarial examples. D is wrong because TLS encryption protects data in transit; it does not affect the model's susceptibility to adversarial inputs.