art.attacks

Module providing adversarial attacks under a common interface.

Base Class Attacks

class art.attacks.Attack(estimator, summary_writer: Union[str, bool, SummaryWriter] = False)

Abstract base class for all attack abstract base classes.

property estimator

The estimator.

property estimator_requirements

The estimator requirements.

static is_estimator_valid(estimator, estimator_requirements) → bool

Checks if the given estimator satisfies the requirements for this attack.

Return type:

bool

Parameters:

  • estimator – The estimator to check.

  • estimator_requirements – Estimator requirements.

Returns:

True if the estimator is valid for the attack.

set_params(**kwargs) → None

Take in a dictionary of parameters and apply attack-specific checks before saving them as attributes.

Parameters:

kwargs – A dictionary of attack-specific parameters.

property summary_writer

The summary writer.

Base Class Evasion Attacks

class art.attacks.EvasionAttack(**kwargs)

Abstract base class for evasion attack classes.

abstract generate(x: ndarray, y: Optional[ndarray] = None, **kwargs) → ndarray

Generate adversarial examples and return them as an array. This method should be overridden by all concrete evasion attack implementations.

Return type:

ndarray

Parameters:

  • x (ndarray) – An array with the original inputs to be attacked.

  • y – Correct labels or target labels for x, depending if the attack is targeted or not. This parameter is only used by some of the attacks.

Returns:

An array holding the adversarial examples.

property targeted: bool

Return Boolean if attack is targeted. Return None if not applicable.

Base Class Poisoning Attacks

class art.attacks.PoisoningAttack(classifier: Optional[CLASSIFIER_TYPE])

Abstract base class for poisoning attack classes

class art.attacks.PoisoningAttackBlackBox

Abstract base class for poisoning attack classes that have no access to the model (classifier object).

class art.attacks.PoisoningAttackWhiteBox(classifier: Optional[CLASSIFIER_TYPE])

Abstract base class for poisoning attack classes that have white-box access to the model (classifier object).

class art.attacks.PoisoningAttackTransformer(classifier: Optional[CLASSIFIER_TYPE])

Abstract base class for poisoning attack classes that return a transformed classifier. These attacks have an additional method, poison_estimator, that returns the poisoned classifier.

abstract poison(x: ndarray, y=typing.Union[numpy.ndarray, NoneType], **kwargs) → Tuple[ndarray, ndarray]

Generate poisoning examples and return them as an array. This method should be overridden by all concrete poisoning attack implementations.

Parameters:

  • x (ndarray) – An array with the original inputs to be attacked.

  • y – Target labels for x. Untargeted attacks set this value to None.

Returns:

An tuple holding the (poisoning examples, poisoning labels).

Return type:

(np.ndarray, np.ndarray)

abstract poison_estimator(x: ndarray, y: ndarray, **kwargs) → CLASSIFIER_TYPE

Returns a poisoned version of the classifier used to initialize the attack :type y: ndarray :type x: ndarray :param x: Training data :param y: Training labels :return: A poisoned classifier

Base Class Extraction Attacks

class art.attacks.ExtractionAttack(estimator, summary_writer: Union[str, bool, SummaryWriter] = False)

Abstract base class for extraction attack classes.

abstract extract(x: ndarray, y: Optional[ndarray] = None, **kwargs) → CLASSIFIER_TYPE

Extract models and return them as an ART classifier. This method should be overridden by all concrete extraction attack implementations.

Parameters:

  • x (ndarray) – An array with the original inputs to be attacked.

  • y – Correct labels or target labels for x, depending if the attack is targeted or not. This parameter is only used by some of the attacks.

Returns:

ART classifier of the extracted model.

Base Class Inference Attacks

class art.attacks.InferenceAttack(estimator)

Abstract base class for inference attack classes.

class art.attacks.AttributeInferenceAttack(estimator, attack_feature: Union[int, slice] = 0)

Abstract base class for attribute inference attack classes.

abstract infer(x: ndarray, y: Optional[ndarray] = None, **kwargs) → ndarray

Infer sensitive attributes from the targeted estimator. This method should be overridden by all concrete inference attack implementations.

Return type:

ndarray

Parameters:

  • x (ndarray) – An array with reference inputs to be used in the attack.

  • y – Labels for x. This parameter is only used by some of the attacks.

Returns:

An array holding the inferred attribute values.

Base Class Reconstruction Attacks

class art.attacks.ReconstructionAttack(estimator)

Abstract base class for reconstruction attack classes.

abstract reconstruct(x: ndarray, y: Optional[ndarray] = None, **kwargs) → Tuple[ndarray, ndarray]

Reconstruct the training dataset of and from the targeted estimator. This method should be overridden by all concrete inference attack implementations.

Return type:

Tuple

Parameters:

  • x (ndarray) – An array with known records of the training set of estimator.

  • y – An array with known labels of the training set of estimator, if None predicted labels will be used.

Returns:

A tuple of two arrays for the reconstructed training input and labels.

set_params(**kwargs) → None

Take in a dictionary of parameters and applies attack-specific checks before saving them as attributes.