← retour aux outils back to tools

# Adversarial Robustness Toolbox (ART)

Bibliothèque Python open source d'IBM regroupant attaques adverses, défenses et métriques de robustesse pour classifiers, détecteurs d'objets, reconnaissance vocale et modèles génératifs. IBM's open-source Python library of adversarial attacks, defenses, and robustness metrics for classifiers, object detectors, speech, and generative models.

↗ https://github.com/Trusted-AI/adversarial-robustness-toolbox

## Overview

ART is the most comprehensive open-source library for adversarial machine learning. It implements evasion, poisoning, extraction, and inference attacks alongside matching defenses (adversarial training, input preprocessing, certified robustness) and evaluation metrics. It’s framework-agnostic — wrapping PyTorch, TensorFlow, Keras, scikit-learn, and Hugging Face models behind a common `Estimator` API — which makes it the go-to when you need to run the same attack across several model backends during an AI red-team engagement.

## Installation

Install with extras for your framework

    pip install adversarial-robustness-toolbox[pytorch]

## Evasion Attack (FGSM against a PyTorch classifier)

    from art.estimators.classification import PyTorchClassifier
    from art.attacks.evasion import FastGradientMethod

    # Wrap your trained model in ART's classifier interface
    classifier = PyTorchClassifier(
        model=model, loss=loss_fn, input_shape=(3, 224, 224),
        nb_classes=1000, clip_values=(0, 1),
    )

    # Craft adversarial examples with a bounded L-inf perturbation
    attack = FastGradientMethod(estimator=classifier, eps=0.03)
    x_adv = attack.generate(x=x_test)

    # Check accuracy drop on adversarial inputs
    preds = classifier.predict(x_adv)

## Poisoning Attack (backdoor injection)

    from art.attacks.poisoning import PoisoningAttackBackdoor
    from art.attacks.poisoning.perturbations import add_pattern_bd

    # Inject a trigger pattern into a fraction of training samples
    backdoor = PoisoningAttackBackdoor(add_pattern_bd)
    x_poison, y_poison = backdoor.poison(x_train, y=target_label, broadcast=True)

## Model Extraction

    from art.attacks.extraction import CopycatCNN

    # Steal a black-box model's decision boundary via query access
    extractor = CopycatCNN(classifier=victim_classifier, nb_epochs=10, nb_stolen=10000)
    stolen_model = extractor.extract(x=query_data, thieved_classifier=blank_classifier)

## Tips

- Use `art.estimators.classification.BlackBoxClassifier` when you only have query access (predict function) to the target — no gradients required for decision-based attacks like `HopSkipJump`.
- `ART`’s `metrics` module (`empirical_robustness`, `clever_score`) is useful for producing a quantitative robustness report, not just individual adversarial samples.

Help / Man page

    art.attacks.evasion       # FastGradientMethod, ProjectedGradientDescent, CarliniL2Method,
                               # DeepFool, HopSkipJump, BoundaryAttack, ...
    art.attacks.poisoning     # PoisoningAttackBackdoor, PoisoningAttackCleanLabelBackdoor, ...
    art.attacks.extraction    # CopycatCNN, KnockoffNets, FunctionallyEquivalentExtraction
    art.attacks.inference     # MembershipInferenceBlackBox, AttributeInferenceBlackBox

    art.estimators.classification  # PyTorchClassifier, TensorFlowV2Classifier, SklearnClassifier
    art.estimators.object_detection
    art.estimators.speech_recognition
    art.estimators.certification   # Randomized smoothing, interval bound propagation

    art.defences.trainer      # AdversarialTrainer
    art.defences.preprocessor # FeatureSqueezing, SpatialSmoothing, JpegCompression
    art.defences.detector     # Activation clustering, spectral signatures (poison detection)

    art.metrics                # empirical_robustness(), clever_score(), loss_sensitivity()

## Vue d’ensemble

ART est la bibliothèque open source la plus complète pour le machine learning adverse. Elle implémente des attaques par évasion, empoisonnement, extraction et inférence, aux côtés des défenses correspondantes (entraînement adverse, prétraitement des entrées, robustesse certifiée) et de métriques d’évaluation. Elle est agnostique du framework : elle enveloppe les modèles PyTorch, TensorFlow, Keras, scikit-learn et Hugging Face derrière une API `Estimator` commune, ce qui en fait la référence quand vous devez lancer la même attaque sur plusieurs backends de modèles pendant une mission de red team IA.

## Installation

    # Installer avec les extras correspondant à votre framework
    pip install adversarial-robustness-toolbox[pytorch]

## Attaque par évasion (FGSM contre un classifier PyTorch)

    from art.estimators.classification import PyTorchClassifier
    from art.attacks.evasion import FastGradientMethod

    # Envelopper votre modèle entraîné dans l'interface classifier d'ART
    classifier = PyTorchClassifier(
        model=model, loss=loss_fn, input_shape=(3, 224, 224),
        nb_classes=1000, clip_values=(0, 1),
    )

    # Fabriquer des exemples adverses avec une perturbation L-inf bornée
    attack = FastGradientMethod(estimator=classifier, eps=0.03)
    x_adv = attack.generate(x=x_test)

    # Vérifier la chute de précision sur les entrées adverses
    preds = classifier.predict(x_adv)

## Attaque par empoisonnement (injection de backdoor)

    from art.attacks.poisoning import PoisoningAttackBackdoor
    from art.attacks.poisoning.perturbations import add_pattern_bd

    # Injecter un motif déclencheur dans une fraction des échantillons d'entraînement
    backdoor = PoisoningAttackBackdoor(add_pattern_bd)
    x_poison, y_poison = backdoor.poison(x_train, y=target_label, broadcast=True)

## Extraction de modèle

    from art.attacks.extraction import CopycatCNN

    # Voler la frontière de décision d'un modèle black-box via un accès en requête
    extractor = CopycatCNN(classifier=victim_classifier, nb_epochs=10, nb_stolen=10000)
    stolen_model = extractor.extract(x=query_data, thieved_classifier=blank_classifier)

## Conseils

- Utilisez `art.estimators.classification.BlackBoxClassifier` quand vous n’avez qu’un accès en requête (fonction predict) à la cible : aucun gradient n’est requis pour les attaques basées sur la décision comme `HopSkipJump`.
- Le module `metrics` d’`ART` (`empirical_robustness`, `clever_score`) est utile pour produire un rapport de robustesse quantitatif, pas seulement des échantillons adverses individuels.

Aide / Page de manuel

    art.attacks.evasion       # FastGradientMethod, ProjectedGradientDescent, CarliniL2Method,
                               # DeepFool, HopSkipJump, BoundaryAttack, ...
    art.attacks.poisoning     # PoisoningAttackBackdoor, PoisoningAttackCleanLabelBackdoor, ...
    art.attacks.extraction    # CopycatCNN, KnockoffNets, FunctionallyEquivalentExtraction
    art.attacks.inference     # MembershipInferenceBlackBox, AttributeInferenceBlackBox

    art.estimators.classification  # PyTorchClassifier, TensorFlowV2Classifier, SklearnClassifier
    art.estimators.object_detection
    art.estimators.speech_recognition
    art.estimators.certification   # Randomized smoothing, interval bound propagation

    art.defences.trainer      # AdversarialTrainer
    art.defences.preprocessor # FeatureSqueezing, SpatialSmoothing, JpegCompression
    art.defences.detector     # Activation clustering, spectral signatures (poison detection)

    art.metrics                # empirical_robustness(), clever_score(), loss_sensitivity()