Adversarial Robustness Toolbox (ART)

ART provides a standardized API for launching evasion, poisoning, extraction, and inference attacks across multiple ML frameworks.

• Evasion Attacks: FGSM, PGD, DeepFool, Carlini-Wagner, and Boundary Attack
• Poisoning Attacks: Backdoor and clean-label poisoning
• Extraction Attacks: Copycat and functionally equivalent extraction
• Inference Attacks: Membership inference and attribute inference

All attacks extend a common Attack base class, ensuring consistent generate() method signatures regardless of the underlying algorithm.

ART operates as an abstraction layer over popular deep learning frameworks, allowing defenses and attacks to be written once and executed anywhere.

• Native support for TensorFlow, PyTorch, Keras, Scikit-learn, XGBoost, and LightGBM
• Estimator wrappers translate framework-specific models into ART-compatible objects
• Gradient computation is handled transparently, whether from PyTorch autograd or TensorFlow GradientTape
• Enables direct comparison of robustness across different model implementations using identical attack parameters

ART implements both empirical and certified defenses as modular components that can be composed into training pipelines.

• Adversarial Training: Injects PGD or FGSM examples during training
• Preprocessing Defenses: Feature squeezing, spatial smoothing, JPEG compression, and thermometer encoding
• Postprocessing Defenses: Randomized smoothing for certified L2 robustness
• Detector Defenses: Trains binary classifiers to distinguish clean from adversarial inputs
• Transformer Defenses: Defensive distillation and label smoothing

ART includes quantitative metrics to measure and certify model robustness beyond simple accuracy scores.

• Empirical Robustness: Computes the minimum perturbation required to flip a prediction
• CLEVER Score: Estimates the Lipschitz constant to bound worst-case vulnerability
• Loss Sensitivity: Measures gradient magnitude as a proxy for local robustness
• Certified Radius: Integrates with randomized smoothing to provide provable L2 guarantees
• Attack Success Rate: Tracks the percentage of adversarial examples that cause misclassification under a given perturbation budget

ART provides tools to rigorously evaluate defenses against adaptive adversaries, preventing the common pitfall of gradient masking.

• Adaptive attack testing: Evaluates defenses against attackers with full knowledge of the defense mechanism
• Sanity checks: Detects gradient masking by verifying that single-step attacks are less effective than iterative attacks
• Transferability testing: Measures how adversarial examples generated on one model transfer to another
• Benchmarking harness: Standardized pipelines for comparing multiple defenses under identical threat models

ART extends beyond evasion to address data integrity threats in the training pipeline.

• Activation Clustering: Detects poisoned training samples by analyzing hidden-layer activations
• STRIP: Identifies backdoored inputs by superimposing clean images and observing prediction entropy
• Neural Cleanse: Reverse-engineers potential backdoor triggers by optimizing for minimal universal perturbations
• Provenance verification: Integrates with data lineage tools to trace training sample origins

A foundational defensive technique that augments training datasets with adversarial examples to improve model resilience. ART provides unified interfaces for generating these examples using attacks like Projected Gradient Descent (PGD) and seamlessly injecting them into training loops.

• Supports data augmentation with pre-computed adversarial samples
• Enables in-training adversarial generation for dynamic hardening
• Compatible with TensorFlow, PyTorch, and scikit-learn estimators

ART standardizes white-box and black-box evasion attacks under a common API. This includes gradient-based methods like Fast Gradient Sign Method (FGSM) and Carlini-Wagner (C&W) , as well as decision-based attacks like HopSkipJump.

• White-box attacks: FGSM, PGD, DeepFool, C&W L2/Linf
• Black-box attacks: Square Attack, HopSkipJump, Zoo
• Consistent generate() interface across all attack classes

ART implements pre-processing, post-processing, and training-time defenses. Feature squeezing reduces input complexity to detect adversaries, while Gaussian data augmentation and spatial smoothing act as input transformations to break adversarial perturbations.

• Preprocessor defenses: JPEG compression, total variance minimization
• Post-processor defenses: reverse sigmoid, high-confidence filtering
• Trainer defenses: adversarial training, TRADES

ART provides detectors that distinguish legitimate samples from adversarial inputs. These include activation-based detection analyzing internal layer outputs and provenance-based detection that flags statistical anomalies in input distributions.

• Detects adversarial examples without modifying the protected model
• Integrates with evasion attacks for automated benchmarking
• Supports binary classification output: clean vs. adversarial

ART standardizes the quantification of model robustness. Empirical robustness measures accuracy against a specific attack, while clever score estimates the minimum perturbation required for misclassification. Loss sensitivity analyzes gradient magnitudes.

• Empirical robustness: attack success rate and accuracy on adversarial examples
• CLEVER score: Lipschitz-based certified robustness estimate
• Verifiable metrics for comparing defense efficacy across models

Beyond evasion, ART implements backdoor attacks that poison training data to create hidden triggers. The clean-label backdoor attack inserts imperceptible patterns that cause targeted misclassification without altering labels.

• Poisoning attacks: backdoor injection, label flipping
• Defenses: activation clustering, spectral signature detection
• Evaluates model integrity against supply chain compromises