A security researcher tests a computer vision model used in autonomous vehicles. She prints a pattern of colored rectangles and tapes them to a stop sign on a test course. The vehicle's AI consistently interprets the stop sign as a 35 mph speed limit sign and does not slow down. The patches are small enough that human drivers still clearly read 'STOP'.
A self-driving car's computer vision system misclassifies a stop sign as a speed-limit sign because an attacker placed specially designed stickers on it. Which type of adversarial ML attack is this?
- A.Model inversion attack
- B.Membership inference attack
- C.Data poisoning backdoor
- D.Adversarial patch attack
Why D is correct
An adversarial patch is a printed, physical perturbation (sticker, pattern) placed on an object in the real world to fool an image classifier. Unlike pixel-level digital perturbations, adversarial patches are robust to viewing angle, lighting, and printing artifacts. Model inversion recovers training data from outputs. Membership inference tests training set membership. Data poisoning backdoors require access to the training pipeline.
Know someone studying for AI Security Fundamentals? Send them this one.