Adversarial Robustness Toolbox (ART)

ART standardizes the interface for both evasion attacks and defensive mechanisms across all major ML frameworks. This allows security engineers to swap between TensorFlow, PyTorch, and scikit-learn backends without rewriting evaluation logic.

• Evasion attacks: Fast Gradient Method, Projected Gradient Descent, Carlini & Wagner
• Poisoning attacks: Backdoor injection, label flipping
• Defenses: Adversarial training, preprocessing, detection

ART implements formal verification methods that provide mathematical guarantees against adversarial manipulation. Unlike empirical defenses that can be broken by adaptive attacks, certification proves a model's prediction remains stable within a defined perturbation radius.

• Randomized Smoothing: Probabilistic certification via noise injection
• Interval Bound Propagation: Propagates input bounds through the network
• Critical for regulatory compliance in financial fraud detection systems

ART provides built-in adversarial detection modules that act as a pre-filter before inputs reach the fraud model. These detectors analyze statistical properties and feature activations to distinguish legitimate transactions from crafted adversarial samples.

• Feature squeezing: Reduces input dimensionality to expose perturbations
• Spatial smoothing: Applies local averaging to neutralize pixel-level attacks
• Training on adversarial examples to build detector classifiers

ART includes countermeasures against model stealing attacks, where adversaries query a fraud detection API to clone its decision boundary. Defenses limit information leakage through prediction outputs.

• Prediction poisoning: Returning intentionally perturbed scores to mislead extractors
• Query monitoring: Detecting anomalous query patterns indicative of extraction
• Preserves intellectual property of proprietary fraud scoring models

Beyond integrity threats, ART simulates confidentiality attacks to audit what a deployed fraud model leaks about its training data. This is essential for GDPR and financial privacy compliance.

• Membership inference: Determining if a specific transaction was in the training set
• Attribute inference: Recovering sensitive features from model outputs
• Model inversion: Reconstructing representative training samples

ART provides standardized evaluation metrics to quantify model resilience, enabling apples-to-apples comparisons across defense strategies. This supports the rigorous testing required by model risk management frameworks.

• Empirical robustness: Accuracy against strongest known attack
• Clever score: Attack success rate under various perturbation budgets
• Certified radius: Provable safe region around each input