Skip to content
AI Security

Interview question · Adversarial ML & Model Privacy

If a model only returns accept or reject, how can an attacker still find inputs that evade it?

Hiding scores slows attackers down; it does not stop them. The scored answer explains decision-based search and transfer, and turns query patterns into a detection opportunity.

hardNewPreparation tags: Google, Amazon, MetaUpdated Nov 2026

Hiding scores slows attackers down; it does not stop them. The scored answer explains decision-based search and transfer, and turns query patterns into a detection opportunity.

Make your first attempt

What would you say before reading the answer?

  1. 01 State the assumptions your answer depends on.
  2. 02 Explain the mechanism and choose a control.
  3. 03 Name a condition that would change your decision.

The worked answer includes an approach, scoring criteria and follow-up questions. Compare the reasoning with your own.

10 answers per topic instead of 5, plus saved progress and bookmarks · costs nothingor unlock all 529 remaining answers · $25

Every worked answer in all 17 topics, every lesson in every course, the full concept curriculum, the complete practice-test bank, and the downloadable security field guides.

6 months · One payment · No auto-renewal

What if · the follow-ups in this answer

The answer works through 6 follow-ups like an interviewer would

A content filter API returns only accept or reject, with no scores, and the team believes this makes adversarial attacks impractical.

  1. Why does hiding scores not stop attacks?
  2. How do transfer attacks avoid queries entirely?
  3. What do decision-based attacks look like in your logs?
  4. What if the filter is used for something attackers want to pass, like moderation?
  5. What should the team conclude about hiding scores?
  6. How would you protect the filter?

Each rung has a nudge, a model answer, the principle that carries over and the weak answer to avoid. Premium opens every answer and ladder.

UP NEXT ON YOUR JOURNEY
Next in this trackHow would you red-team a fraud detection model?Next in this trackWhat is clean-label poisoning, and why is it harder to catch than label flipping?Next in this trackHow much poisoned data does an attacker need, and why does that matter at web scale?
DISCUSSION · 0

No comments yet. Share a correction or a different way to answer it.