Adversarial Robustness Toolbox (ART)

Overview

ART is the most comprehensive open-source library for adversarial machine learning. It implements evasion, poisoning, extraction, and inference attacks alongside matching defenses (adversarial training, input preprocessing, certified robustness) and evaluation metrics. It’s framework-agnostic — wrapping PyTorch, TensorFlow, Keras, scikit-learn, and Hugging Face models behind a common Estimator API — which makes it the go-to when you need to run the same attack across several model backends during an AI red-team engagement.

Installation

Install with extras for your framework

pip install adversarial-robustness-toolbox[pytorch]

Evasion Attack (FGSM against a PyTorch classifier)

from art.estimators.classification import PyTorchClassifier
from art.attacks.evasion import FastGradientMethod

# Wrap your trained model in ART's classifier interface
classifier = PyTorchClassifier(
    model=model, loss=loss_fn, input_shape=(3, 224, 224),
    nb_classes=1000, clip_values=(0, 1),
)

# Craft adversarial examples with a bounded L-inf perturbation
attack = FastGradientMethod(estimator=classifier, eps=0.03)
x_adv = attack.generate(x=x_test)

# Check accuracy drop on adversarial inputs
preds = classifier.predict(x_adv)

Poisoning Attack (backdoor injection)

from art.attacks.poisoning import PoisoningAttackBackdoor
from art.attacks.poisoning.perturbations import add_pattern_bd

# Inject a trigger pattern into a fraction of training samples
backdoor = PoisoningAttackBackdoor(add_pattern_bd)
x_poison, y_poison = backdoor.poison(x_train, y=target_label, broadcast=True)

Model Extraction

from art.attacks.extraction import CopycatCNN

# Steal a black-box model's decision boundary via query access
extractor = CopycatCNN(classifier=victim_classifier, nb_epochs=10, nb_stolen=10000)
stolen_model = extractor.extract(x=query_data, thieved_classifier=blank_classifier)

Tips

• Use art.estimators.classification.BlackBoxClassifier when you only have query access (predict function) to the target — no gradients required for decision-based attacks like HopSkipJump.
• ART’s metrics module (empirical_robustness, clever_score) is useful for producing a quantitative robustness report, not just individual adversarial samples.

art.attacks.evasion       # FastGradientMethod, ProjectedGradientDescent, CarliniL2Method,
                           # DeepFool, HopSkipJump, BoundaryAttack, ...
art.attacks.poisoning     # PoisoningAttackBackdoor, PoisoningAttackCleanLabelBackdoor, ...
art.attacks.extraction    # CopycatCNN, KnockoffNets, FunctionallyEquivalentExtraction
art.attacks.inference     # MembershipInferenceBlackBox, AttributeInferenceBlackBox

art.estimators.classification  # PyTorchClassifier, TensorFlowV2Classifier, SklearnClassifier
art.estimators.object_detection
art.estimators.speech_recognition
art.estimators.certification   # Randomized smoothing, interval bound propagation

art.defences.trainer      # AdversarialTrainer
art.defences.preprocessor # FeatureSqueezing, SpatialSmoothing, JpegCompression
art.defences.detector     # Activation clustering, spectral signatures (poison detection)

art.metrics                # empirical_robustness(), clever_score(), loss_sensitivity()

Vue d’ensemble

ART est la bibliothèque open source la plus complète pour le machine learning adverse. Elle implémente des attaques par évasion, empoisonnement, extraction et inférence, aux côtés des défenses correspondantes (entraînement adverse, prétraitement des entrées, robustesse certifiée) et de métriques d’évaluation. Elle est agnostique du framework : elle enveloppe les modèles PyTorch, TensorFlow, Keras, scikit-learn et Hugging Face derrière une API Estimator commune, ce qui en fait la référence quand vous devez lancer la même attaque sur plusieurs backends de modèles pendant une mission de red team IA.

Installation

# Installer avec les extras correspondant à votre framework
pip install adversarial-robustness-toolbox[pytorch]

Attaque par évasion (FGSM contre un classifier PyTorch)

from art.estimators.classification import PyTorchClassifier
from art.attacks.evasion import FastGradientMethod

# Envelopper votre modèle entraîné dans l'interface classifier d'ART
classifier = PyTorchClassifier(
    model=model, loss=loss_fn, input_shape=(3, 224, 224),
    nb_classes=1000, clip_values=(0, 1),
)

# Fabriquer des exemples adverses avec une perturbation L-inf bornée
attack = FastGradientMethod(estimator=classifier, eps=0.03)
x_adv = attack.generate(x=x_test)

# Vérifier la chute de précision sur les entrées adverses
preds = classifier.predict(x_adv)

Attaque par empoisonnement (injection de backdoor)

from art.attacks.poisoning import PoisoningAttackBackdoor
from art.attacks.poisoning.perturbations import add_pattern_bd

# Injecter un motif déclencheur dans une fraction des échantillons d'entraînement
backdoor = PoisoningAttackBackdoor(add_pattern_bd)
x_poison, y_poison = backdoor.poison(x_train, y=target_label, broadcast=True)

Extraction de modèle

from art.attacks.extraction import CopycatCNN

# Voler la frontière de décision d'un modèle black-box via un accès en requête
extractor = CopycatCNN(classifier=victim_classifier, nb_epochs=10, nb_stolen=10000)
stolen_model = extractor.extract(x=query_data, thieved_classifier=blank_classifier)

Conseils

• Utilisez art.estimators.classification.BlackBoxClassifier quand vous n’avez qu’un accès en requête (fonction predict) à la cible : aucun gradient n’est requis pour les attaques basées sur la décision comme HopSkipJump.
• Le module metrics d’ART (empirical_robustness, clever_score) est utile pour produire un rapport de robustesse quantitatif, pas seulement des échantillons adverses individuels.

art.attacks.evasion       # FastGradientMethod, ProjectedGradientDescent, CarliniL2Method,
                           # DeepFool, HopSkipJump, BoundaryAttack, ...
art.attacks.poisoning     # PoisoningAttackBackdoor, PoisoningAttackCleanLabelBackdoor, ...
art.attacks.extraction    # CopycatCNN, KnockoffNets, FunctionallyEquivalentExtraction
art.attacks.inference     # MembershipInferenceBlackBox, AttributeInferenceBlackBox

art.estimators.classification  # PyTorchClassifier, TensorFlowV2Classifier, SklearnClassifier
art.estimators.object_detection
art.estimators.speech_recognition
art.estimators.certification   # Randomized smoothing, interval bound propagation

art.defences.trainer      # AdversarialTrainer
art.defences.preprocessor # FeatureSqueezing, SpatialSmoothing, JpegCompression
art.defences.detector     # Activation clustering, spectral signatures (poison detection)

art.metrics                # empirical_robustness(), clever_score(), loss_sensitivity()