CoChat
Sign Up
PreprintCited by 8

Adversarial Robustness Toolbox v1.0.0

Nicolae, Maria-Irina, Sinn, Mathieu, Tran, Minh Ngoc, Buesser, Beat, Rawat, Ambrish, Wistuba, Martin, Zantedeschi, Valentina, Baracaldo, Nathalie +4 more·2018·arXiv
DOI 10.48550/arxiv.1807.01069arXiv 1807.01069
Open this paper in CoChat — free account

Abstract

Adversarial Robustness Toolbox (ART) is a Python library supporting developers and researchers in defending Machine Learning models (Deep Neural Networks, Gradient Boosted Decision Trees, Support Vector Machines, Random Forests, Logistic Regression, Gaussian Processes, Decision Trees, Scikit-learn Pipelines, etc.) against adversarial threats and helps making AI systems more secure and trustworthy. Machine Learning models are vulnerable to adversarial examples, which are inputs (images, texts, tabular data, etc.) deliberately modified to produce a desired response by the Machine Learning model. ART provides the tools to build and deploy defences and test them with adversarial attacks. Defending Machine Learning models involves certifying and verifying model robustness and model hardening with approaches such as pre-processing inputs, augmenting training data with adversarial samples, and leveraging runtime detection methods to flag any inputs that might have been modified by an adversary. The attacks implemented in ART allow creating adversarial attacks against Machine Learning models which is required to test defenses with state-of-the-art threat models. Supported Machine Learning Libraries include TensorFlow (v1 and v2), Keras, PyTorch, MXNet, Scikit-learn, XGBoost, LightGBM, CatBoost, and GPy. The source code of ART is released with MIT license at https://github.com/IBM/adversarial-robustness-toolbox. The release includes code examples, notebooks with tutorials and documentation (http://adversarial-robustness-toolbox.readthedocs.io).

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

DataCite · 10.48550/arxiv.1807.01069

Cites

1 of 1 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Various toolboxes have been released in the past years to assist algorithm experimentation and software development to enhance AI trustworthiness in different aspects such as fairness [12, 13, 71], XAI [56, 1, 8], and adversarial robustness [55, 2].

    “Various toolboxes have been released in the past years to assist the algorithm experimentation and software development to enhance AI trustworthiness in different aspects such as fairness [12, 13, 71], XAI [56, 1, 8], and adversarial robustness [55, 2].”

    From Trustworthy AI: From Principles to Practices (2023) · cites this paper as [55]

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

Flagged first, then by citations

Research works printed but not linked: 48

  1. Anish Athalye, Logan Engstrom, Andrew Ilyas, and Kevin Kwok. Synthesizing robust adversarial examples. CoRR, abs/1707.07397, 2017. URL https://arxiv.org/abs/1707. 07397. · arXiv
  2. Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. CoRR, abs/1802.00420, 2018. URL https://arxiv.org/abs/1802.00420. · arXiv
  3. Nathalie Baracaldo, Bryant Chen, Heiko Ludwig, and Jaehoon Amir Safavi. Mitigating poi- soning attacks on machine learning models: A data provenance based approach. In Proceed- ings of the 10th ACM Workshop on Artificial Intelligence and Security, AISec '17, pages 103-110, New York, NY, USA, 2017. ACM. ISBN 978-1-4503-5202-4. doi: 10.1145/3128572.3140450. URL http://doi.acm.org/10.1145/3128572.3140450. · DOI · Paper page
  4. Marco Barreno, Blaine Nelson, Anthony D. Joseph, , and J. D. Tygar. The security of ma- chine learning. Machine Learning, 81(2):121-148, 2010. doi: 10.1007/s10994-010-5188-5. URL https://doi.org/10.1007/s10994-010-5188-5. · DOI
  5. Battista Biggio, Igino Corona, Davide Maiorca, Blaine Nelson, Nedim Šrndić, Pavel Laskov, Giorgio Giacinto, and Fabio Roli. Evasion attacks against machine learning at test time. In Joint European Conference on Machine Learning and Knowledge Discovery in Databases, pages 387-402. Springer, 2013.
  6. Battista Biggio, Luca Didaci, Giorgio Fumera, and Fabio Roli. Poisoning attacks to compro- mise face templates. In Biometrics (ICB), 2013 Int. Conference on, pages 1-7. IEEE, 2013.
  7. Battista Biggio, Giorgio Fumera, and Fabio Roli. Security evaluation of pattern classi- fiers under attack. 26:984-996, 2014. URL https://www.researchgate.net/publication/ 240383291_Security_Evaluation_of_Pattern_Classifiers_Under_Attack.
  8. Wieland Brendel, Jonas Rauber, and Matthias Bethge. Decision-based adversarial attacks: Reliable attacks against black-box machine learning models. CoRR, 1712.04248, 2017. URL https://arxiv.org/pdf/1712.04248. * https://semver.org · arXiv
  9. Tom B. Brown, Dandelion Mané, Aurko Roy, Martín Abadi, and Justin Gilmer. Adversarial patch. CoRR, abs/1712.09665, 2017. URL https://arxiv.org/abs/1712.09665. · arXiv
  10. Jacob Buckman, Aurko Roy, Colin Raffel, and Ian Goodfellow. Thermometer encoding: One hot way to resist adversarial examples. In International Conference on Learning Representations (ICLR), 2018. URL https://openreview.net/forum?id=S18Su--CW.
  11. Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In IEEE Symposium on Security and Privacy, 2017. URL https://arxiv.org/abs/1608.04644. · arXiv
  12. Bryant Chen, Wilka Carvalho, Nathalie Baracaldo, Heiko Ludwig, Benjamin Edwards, Lee Taesung, Ian Molloy, and Biplav Srivastava. Detecting backdoor attacks on deep neural networks by activation clustering, 2018. URL https://arxiv.org/pdf/1811.03728.pdf. · arXiv
  13. Hongge Chen, Huan Zhang, Si Si, Yang Li, Duane S. Boning, and ChoJui Hsieh. Robustness verification of tree-based models. CoRR, abs/1906.03849, 2019. URL http://arxiv.org/ abs/1906.03849. · arXiv
  14. Jianbo Chen and Michael I. Jordan. Boundary attack++: Query-efficient decision-based ad- versarial attack. CoRR, abs/1904.02144, 2019. URL http://arxiv.org/abs/1904.02144. · arXiv
  15. Pin-Yu Chen, Yash Sharma, Huan Zhang, Jinfeng Yi, and Cho-Jui Hsieh. Ead: Elastic-net attacks to deep neural networks via adversarial examples. CoRR, abs/1709.04114, 2017. URL https://arxiv.org/abs/1709.04114. · arXiv
  16. Pin-Yu Chen, Huan Zhang, Yash Sharma, Jinfeng Yi, and Cho-Jui Hsieh. Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models. CoRR, abs/1708.03999, 2017. URL https://arxiv.org/abs/. · arXiv
  17. Elan cohen, Jeremy M.and Rosenfeld and J. Zico Kolter. Certified adversarial robustness via randomized smoothing. CoRR, abs/1902.02918, 2019. URL http://arxiv.org/abs/1902. 02918. · arXiv
  18. Nilaksh Das, Madhuri Shanbhogue, Shang-Tse Chen, Fred Hohman, Li Chen, Michael E. Kounavis, and Duen Horng Chau. Keeping the bad guys out: Protecting and vaccinating deep learning with JPEG compression. CoRR, abs/1705.02900, 2017. URL http://arxiv. org/abs/1705.02900. · arXiv
  19. Gintare Karolina Dziugaite, Zoubin Ghahramani, and Daniel M. Roy. A study of the effect of JPG compression on adversarial images. CoRR, abs/1608.00853, 2016. URL http://arxiv. org/abs/1608.00853. · arXiv
  20. Logan Engstrom, Brandon Tran, Dimitris Tsipras, Ludwig Schmidt, and Aleksander Madry. A rotation and a translation suffice: Fooling cnns with simple transformations. CoRR, abs/1712.02779, 2017. URL http://arxiv.org/abs/1712.02779. · arXiv
  21. Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing ad- versarial examples. CoRR, abs/1412.6572, 2014. URL http://arxiv.org/abs/1412.6572. · arXiv
  22. Kathrin Grosse, David Pfaff, Michael T. Smith, and Michael Backes. The limitations of model uncertainty in adversarial settings. CoRR, abs/1812.02606, 2018. URL http://arxiv.org/ abs/1812.02606. · arXiv
  23. Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. Badnets: Identifying vulnerabilities in the machine learning model supply chain. CoRR, abs/1708.06733, 2017. URL http:// arxiv.org/abs/1708.06733. · arXiv
  24. Chuan Guo, Mayank Rana, Moustapha Cisse, and Laurens van der Maaten. Countering adversarial images using input transformations. In International Conference on Learning Rep- resentations (ICLR), 2018. URL https://arxiv.org/abs/1711.00117. · arXiv
  25. Matthias Hein and Maksym Andriushchenko. Formal guarantees on the robustness of a clas- sifier against adversarial manipulation. CoRR, 2017. URL https://arxiv.org/abs/1705. 08475.
  26. Ling Huang, Anthony D. Joseph, Blaine Nelson, Benjamin I.P. Rubinstein, and J. D. Tygar. Adversarial machine learning. In Proceedings of the 4th ACM Workshop on Security and Artificial Intelligence, AISec '11, pages 43-58, New York, NY, USA, 2011. ACM. ISBN 978-1-4503-1003- 1. doi: 10.1145/2046684.2046692. URL http://doi.acm.org/10.1145/2046684.2046692. · DOI · Paper page
  27. Andrew Ilyas, Logan Engstrom, Anish Athalye, and Jessy Lin. Query-efficient black-box adversarial examples. CoRR, abs/1712.07113, 2017. URL https://arxiv.org/abs/1712. 07113. · arXiv
  28. Uyeong Jang, Xi Wu, and Somesh Jha. Objective metrics and gradient descent algorithms for adversarial examples in machine learning. In Annual Computer Security Applications Con- ference (ACSAC), pages 262-277, New York, NY, USA, 2017. ACM. ISBN 978-1-4503-5345-8. doi: 10.1145/3134600.3134635. URL http://doi.acm.org/10.1145/3134600.3134635. · DOI
  29. David Krueger, Nicolas Ballas, Stanislaw Jastrzebski, Devansh Arpit, Maxinder S. Kanwal, Tegan Maharaj, Emmanuel Bengio, Asja Fischer, Aaron Courville, Simon Lacoste-Julien, and Yoshua Bengio. A closer look at memorization in deep networks. In International Conference on Machine Learning (ICML), 2017. URL https://arxiv.org/abs/1706.05394. · arXiv
  30. Yuntao Liu, Yang Xie, and Ankur Srivastava. Neural trojans. In Computer Design (ICCD), 2017 IEEE Int. Conf. on, 2017.
  31. Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. CoRR, abs/1706.06083, 2017. URL https://arxiv.org/abs/1706.06083. · arXiv
  32. Edward III McFowland, Skyler Speakman, and Daniel B. Neill. Fast generalized subset scan for anomalous pattern detection. Journal of Machine Learning Research, 14:1533-1561, 2013.
  33. Dongyu Meng and Hao Chen. Magnet: a two-pronged defense against adversarial examples. In ACM Conference on Computer and Communications Security (CCS), 2017. URL https:// arxiv.org/abs/1705.09064. · arXiv
  34. Takeru Miyato, Shin-ichi Maeda, Masanori Koyama, Ken Nakae, and Shin Ishii. Distribu- tional smoothing with virtual adversarial training. arXiv preprint arXiv:1507.00677, 2015. · arXiv
  35. Takeru Miyato, Shin-ichi Maeda, Masanori Koyama, and Shin Ishii. Virtual adversarial train- ing: a regularization method for supervised and semi-supervised learning. arXiv preprint arXiv:1704.03976, 2017. · arXiv
  36. Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, and Pascal Frossard. Deepfool: a simple and accurate method to fool deep neural networks. CoRR, abs/1511.04599, 2015. URL http: //arxiv.org/abs/1511.04599. · arXiv
  37. Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. Uni- versal adversarial perturbations. CoRR, abs/1610.08401, 2016. URL http://arxiv.org/abs/ 1610.08401. · arXiv
  38. Luis Mu ñoz-González, Battista Biggio, Ambra Demontis, Andrea Paudice, Vasin Wongras- samee, Emil C Lupu, and Fabio Roli. Towards poisoning of deep learning algorithms with back-gradient optimization. arXiv preprint arXiv:1708.08689, 2017. · arXiv
  39. Nicolas Papernot, Patrick D. McDaniel, Somesh Jha, Matt Fredrikson, Z. Berkay Celik, and Ananthram Swami. The limitations of deep learning in adversarial settings. CoRR, abs/1511.07528, 2015. URL http://arxiv.org/abs/1511.07528. · arXiv
  40. Nicolas Papernot, Patrick McDaniel, and Ian Goodfellow. Transferability in machine learn- ing: from phenomena to black-box attacks using adversarial samples. CoRR, 1605.07277, 2016. URL https://arxiv.org/pdf/1605.07277. · arXiv
  41. Nicolas Papernot, Patrick D. McDaniel, Arunesh Sinha, and Michael P. Wellman. Towards the science of security and privacy in machine learning. CoRR, abs/1611.03814, 2016. URL http://arxiv.org/abs/1611.03814. · arXiv
  42. Andrew Slavin Ross and Finale Doshi-Velez. Improving the adversarial robustness and inter- pretability of deep neural networks by regularizing their input gradients. CoRR, 1711.09404, 2017. URL https://arxiv.org/pdf/1711.09404. · arXiv
  43. Yang Song, Taesup Kim, Sebastian Nowozin, Stefano Ermon, and Nate Kushman. Pix- eldefend: Leveraging generative models to understand and defend against adversarial ex- amples. In International Conference on Learning Representations (ICLR), 2018. URL https: //openreview.net/forum?id=rJUYGxbCW.
  44. Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Goodfellow, and Rob Fergus. Intriguing properties of neural networks. CoRR, abs/1312.6199, 2013. URL http://arxiv.org/abs/1312.6199. · arXiv
  45. Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Dan Boneh, and Patrick McDaniel. En- semble adversarial training: Attacks and defenses. In International Conference on Learning Representations (ICLR), 2018. URL https://arxiv.org/abs/1705.07204. · arXiv
  46. Tsui-Wei Weng, Huan Zhang, Pin-Yu Chen, Jinfeng Yi, Dong Su, Yupeng Gao, Cho-Jui Hsieh, and Luca Daniel. Evaluating the robustness of neural networks: An extreme value theory approach. In International Conference on Learning Representations (ICLR), 2018. URL https: //openreview.net/forum?id=BkUHlMZ0b.
  47. Weilin Xu, David Evans, and Yanjun Qi. Feature squeezing: Detecting adversarial examples in deep neural networks. CoRR, abs/1704.01155, 2017. URL http://arxiv.org/abs/1704. 01155. · arXiv
  48. Valentina Zantedeschi, Maria-Irina Nicolae, and Ambrish Rawat. Efficient defenses against adversarial attacks. In ACM Workshop on Artificial Intelligence and Security (AISec), pages 39- 49. ACM, 2017. URL http://doi.acm.org/10.1145/3128572.3140449. · DOI

Cited by

Sorted by citations

Authors
Nicolae, M.-I., Sinn, M., Tran, M. N., Buesser, B., Rawat, A., Wistuba, M., Zantedeschi, V., Baracaldo, N., Chen, B., Ludwig, H., Molloy, I. M., & Edwards, B.
Venue
arXiv
Publisher
arXiv
Published
2018
DOI
10.48550/arxiv.1807.01069
arXiv
1807.01069
References
1
Type
Preprint
Licence
arxiv.org/licenses/nonexclusive-distrib/1.0/

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review