adversarial robustness toolbox

ART provides implementations of attack methods across all major threat vectors alongside corresponding defenses, enabling security researchers and ML engineers to evaluate model robustness and implement hardening measures.

The library covers attacks including FGSM, PGD, C&W, DeepFool, and AutoAttack for evasion, backdoor and clean-label poisoning attacks for training data corruption, membership inference and model inversion for privacy attacks, and black-box attacks that require only prediction outputs rather than model gradients.

Corresponding defenses include adversarial training, certified robustness via randomized smoothing, input preprocessing defenses, and ensemble methods. ART works with TensorFlow, PyTorch, scikit-learn, XGBoost, and Keras models through a consistent API.

ART is open-source under the MIT license and maintained by IBM Research as part of its AI safety research program.

It is used by ML security teams conducting red-team evaluations of production models, academic researchers publishing robustness benchmarks, and compliance teams assessing AI system security posture for regulated deployment contexts.

The toolbox is a reference implementation for the field of adversarial ML, with coverage extending to audio, video, tabular, and natural language domains beyond the computer vision focus of earlier robustness research.