Adversarial Robustness Toolbox (ART)

ART provides a unified interface for implementing defenses across TensorFlow, PyTorch, Keras, and scikit-learn without rewriting code. This abstraction layer allows security engineers to apply adversarial training, preprocessing defenses, and detection mechanisms consistently.

• Supports gradient masking, feature squeezing, and JPEG compression defenses
• Wraps any classifier with a single API call
• Enables direct comparison of defense efficacy across frameworks

ART implements the canonical taxonomy of adversarial attacks, from white-box gradient-based methods to black-box query-based approaches. This allows red teams to stress-test models against realistic threat vectors.

• Evasion attacks: FGSM, PGD, DeepFool, Carlini & Wagner
• Poisoning attacks: Backdoor injection via clean-label and dirty-label methods
• Extraction attacks: KnockoffNets and functionally equivalent model stealing
• Inference attacks: Membership inference and attribute inference for privacy auditing

Beyond empirical evaluation, ART integrates formal verification methods that provide mathematical guarantees on model behavior under bounded perturbations. This moves security posture from best-effort to provable guarantees.

• Implements randomized smoothing for L2 and L-infinity certified radii
• Supports interval bound propagation for neural network verification
• Generates certificates that a prediction will not change within a specified epsilon-ball

ART bridges adversarial robustness with privacy-enhancing technologies, offering native implementations of Differentially Private Stochastic Gradient Descent (DP-SGD) and integration with cryptographic protocols.

• Built-in DP-SGD optimizer with per-sample gradient clipping and Gaussian noise injection
• Supports membership inference risk auditing to quantify training data leakage
• Compatible with federated learning pipelines for decentralized, privacy-compliant training

ART provides a rigorous evaluation framework that computes standardized robustness metrics, enabling reproducible comparisons across research papers and production systems.

• Calculates empirical robustness against AutoAttack and other standardized ensembles
• Measures clever score and loss sensitivity for defense characterization
• Generates detection ROC curves for evasion and poisoning detection mechanisms
• Integrates with RobustBench model zoo for baseline comparisons

ART includes trainable detector modules that identify adversarial inputs at inference time, coupled with response mechanisms that can reject, sanitize, or log suspicious queries.

• Adversarial detector training using feature squeezing and LID (Local Intrinsic Dimensionality)
• Poisoning detection via activation clustering and spectral signature analysis
• Configurable response actions: abstain, transform, or route to human review
• Designed for integration into secure model serving pipelines

A foundational defensive methodology that augments training data with adversarial examples generated on-the-fly. ART provides unified interfaces for Projected Gradient Descent (PGD) and Fast Gradient Sign Method (FGSM) attacks to inject into training loops.

• Forces the model to learn robust decision boundaries
• Directly minimizes loss on worst-case perturbations
• Standard implementation via art.defences.trainer.AdversarialTrainer

ART implements Randomized Smoothing to build a provably robust classifier from any base model. By adding isotropic Gaussian noise and returning the most probable prediction, it provides a certified radius within which no adversarial perturbation can change the output.

• Transforms a brittle model into a certifiably robust one
• Provides a mathematical lower bound on robustness
• Accessible via art.defences.preprocessor.GaussianAugmentation

ART integrates AutoAttack, a parameter-free ensemble of diverse white-box and black-box attacks. It serves as the gold standard for empirical robustness evaluation, combining APGD-CE, APGD-DLR, FAB, and Square Attack.

• Eliminates false security from gradient masking
• Provides a standardized, reproducible evaluation protocol
• Exposed via art.attacks.evasion.AutoAttack

ART provides detection mechanisms against Model Extraction attacks where adversaries query an API to steal model functionality. Defenses include limiting prediction confidence and detecting anomalous query patterns.

• Monitors query distribution for extraction signatures
• Truncates softmax outputs to reduce information leakage
• Implemented via art.defences.detector.poison module patterns

ART supports privacy-preserving training through Differentially Private Stochastic Gradient Descent (DP-SGD). This clips per-sample gradients and injects calibrated Gaussian noise, providing provable membership inference resistance.

• Bounds the influence of any single training sample
• Provides an (ε, δ)-differential privacy guarantee
• Integrated via art.defences.trainer.AdversarialTrainer with privacy flags

ART enforces a rigorous Threat Model abstraction that defines the adversary's knowledge (white-box vs black-box), goals (evasion vs poisoning), and perturbation constraints via Lp norms.

• L0: Number of modified pixels
• L2: Euclidean distance of perturbation
• L-infinity: Maximum per-pixel change
• Central to selecting compatible attacks and defenses