CleverHans

Provides canonical, reference-grade implementations of major adversarial attacks, enabling reproducible research and consistent benchmarking.

• Fast Gradient Sign Method (FGSM): Single-step white-box attack using the sign of the loss gradient
• Projected Gradient Descent (PGD): Iterative, multi-step variant considered a universal first-order adversary
• Carlini & Wagner (C&W): Optimization-based attack finding minimally distorted adversarial examples
• DeepFool: Iterative attack computing minimal perturbations to cross the decision boundary
• JSMA (Jacobian-based Saliency Map Attack): Greedy attack modifying the most salient pixels for a target class

Implements a comprehensive suite of defensive strategies to harden models against adversarial manipulation, allowing direct comparison of mitigation efficacy.

• Adversarial Training: Augments training data with on-the-fly generated adversarial examples to learn robust decision boundaries
• Ensemble Adversarial Training: Trains using adversarial examples crafted from multiple source models to improve transferability robustness
• Defensive Distillation: Uses soft probability vectors from a teacher model to smooth the loss landscape and reduce gradient magnitudes

Designed with a modular architecture that abstracts attack and defense logic from the underlying deep learning framework, supporting the most widely used ecosystems.

• TensorFlow: Native and most mature backend with full feature parity
• PyTorch: Full support via cleverhans.torch module for PyTorch-native workflows
• JAX: Experimental support for high-performance, composable function transformations
• NumPy: Reference implementations for pedagogical and lightweight use cases

Includes utilities for systematic evaluation of model robustness using standardized metrics, enabling apples-to-apples comparisons across different defense proposals.

• Attack Success Rate: Percentage of adversarial examples that cause misclassification
• Robust Accuracy: Model accuracy evaluated on a fully perturbed test set
• Perturbation Magnitude: Measures the Lp-norm distance between original and adversarial inputs
• Report Generation: Tools to produce structured benchmarking reports for academic and industry use

Ships with extensive Jupyter notebook tutorials that walk through attack and defense concepts step-by-step, directly tied to published academic research.

• FGSM Tutorial: End-to-end walkthrough of generating and defending against fast gradient attacks on MNIST and CIFAR-10
• Adversarial Training Tutorial: Demonstrates PGD-based adversarial training to achieve measurable robustness gains
• C&W Attack Tutorial: Detailed explanation of the optimization formulation and hyperparameter tuning
• All tutorials are self-contained and designed to produce results matching published benchmarks

Developed and maintained by the Google Brain team and the broader academic community, with contributions from leading adversarial ML researchers worldwide.

• Originated from the seminal paper "CleverHans v2.1.0: An Adversarial Machine Learning Library" by Papernot et al.
• Serves as the reference implementation for hundreds of peer-reviewed papers in top venues like NeurIPS, ICML, and ICLR
• Governed under the Linux Foundation's Adversarial Robustness Toolbox (ART) umbrella for long-term stewardship

An input to a machine learning model that has been intentionally perturbed in a way imperceptible to humans, causing the model to make an incorrect classification with high confidence. These perturbations are typically constrained within a small Lp-norm epsilon-ball around the original input.

• White-box attacks: Attacker has full access to model gradients
• Black-box attacks: Attacker only observes input-output pairs
• Physical attacks: Perturbations that survive real-world conditions like camera capture

A single-step, white-box attack introduced by Goodfellow et al. that creates adversarial examples by adding a small perturbation in the direction of the gradient of the loss function with respect to the input. The perturbation magnitude is controlled by the hyperparameter epsilon.

• Computationally efficient: requires only one backward pass
• Formula: x_adv = x + ε * sign(∇_x J(θ, x, y))
• Serves as a baseline for evaluating more sophisticated attacks

A powerful iterative white-box attack that repeatedly applies FGSM with a small step size and projects the result back onto an epsilon-ball around the original input. PGD is widely considered a first-order universal adversary and serves as the standard benchmark for evaluating adversarial robustness.

• Multi-step variant: applies FGSM k times with step size α
• Projection ensures perturbation stays within L∞ bounds
• Often used as the inner maximization step in adversarial training

A defensive technique that augments the training dataset with adversarial examples generated against the current model state, forcing the model to learn a more robust decision boundary. This is the most empirically effective defense against adversarial attacks.

• Min-max formulation: outer minimization on clean loss, inner maximization on adversarial loss
• PGD-based adversarial training is the de facto standard
• Trade-off: typically reduces clean accuracy while improving robust accuracy