art.attacks

Module providing adversarial attacks under a common interface.

Base Class Attacks

class art.attacks.Attack(estimator, summary_writer: Union[str, bool, SummaryWriter] = False)

Abstract base class for all attack abstract base classes.

property estimator

The estimator.

property estimator_requirements

The estimator requirements.

static is_estimator_valid(estimator, estimator_requirements) → bool

Checks if the given estimator satisfies the requirements for this attack.

Return type

bool

Parameters

  • estimator – The estimator to check.

  • estimator_requirements – Estimator requirements.

Returns

True if the estimator is valid for the attack.

set_params(**kwargs) → None

Take in a dictionary of parameters and apply attack-specific checks before saving them as attributes.

Parameters

kwargs – A dictionary of attack-specific parameters.

property summary_writer

The summary writer.

Base Class Evasion Attacks

class art.attacks.EvasionAttack(**kwargs)

Abstract base class for evasion attack classes.

abstract generate(x: ndarray, y: Optional[ndarray] = None, **kwargs) → ndarray

Generate adversarial examples and return them as an array. This method should be overridden by all concrete evasion attack implementations.

Return type

ndarray

Parameters

  • x (ndarray) – An array with the original inputs to be attacked.

  • y – Correct labels or target labels for x, depending if the attack is targeted or not. This parameter is only used by some of the attacks.

Returns

An array holding the adversarial examples.

property targeted: bool

Return Boolean if attack is targeted. Return None if not applicable.

Base Class Poisoning Attacks

class art.attacks.PoisoningAttack(classifier: Optional[CLASSIFIER_TYPE])

Abstract base class for poisoning attack classes

class art.attacks.PoisoningAttackBlackBox

Abstract base class for poisoning attack classes that have no access to the model (classifier object).

class art.attacks.PoisoningAttackWhiteBox(classifier: Optional[CLASSIFIER_TYPE])

Abstract base class for poisoning attack classes that have white-box access to the model (classifier object).

class art.attacks.PoisoningAttackTransformer(classifier: Optional[CLASSIFIER_TYPE])

Abstract base class for poisoning attack classes that return a transformed classifier. These attacks have an additional method, poison_estimator, that returns the poisoned classifier.

abstract poison(x: ndarray, y=typing.Union[numpy.ndarray, NoneType], **kwargs) → Tuple[ndarray, ndarray]

Generate poisoning examples and return them as an array. This method should be overridden by all concrete poisoning attack implementations.

Parameters

  • x (ndarray) – An array with the original inputs to be attacked.

  • y – Target labels for x. Untargeted attacks set this value to None.

Returns

An tuple holding the (poisoning examples, poisoning labels).

Return type

(np.ndarray, np.ndarray)

abstract poison_estimator(x: ndarray, y: ndarray, **kwargs) → CLASSIFIER_TYPE

Returns a poisoned version of the classifier used to initialize the attack :type y: ndarray :type x: ndarray :param x: Training data :param y: Training labels :return: A poisoned classifier

Base Class Extraction Attacks

class art.attacks.ExtractionAttack(estimator, summary_writer: Union[str, bool, SummaryWriter] = False)

Abstract base class for extraction attack classes.

abstract extract(x: ndarray, y: Optional[ndarray] = None, **kwargs) → CLASSIFIER_TYPE

Extract models and return them as an ART classifier. This method should be overridden by all concrete extraction attack implementations.

Parameters

  • x (ndarray) – An array with the original inputs to be attacked.

  • y – Correct labels or target labels for x, depending if the attack is targeted or not. This parameter is only used by some of the attacks.

Returns

ART classifier of the extracted model.

Base Class Inference Attacks

class art.attacks.InferenceAttack(estimator)

Abstract base class for inference attack classes.

class art.attacks.AttributeInferenceAttack(estimator, attack_feature: Union[int, slice] = 0)

Abstract base class for attribute inference attack classes.

abstract infer(x: ndarray, y: Optional[ndarray] = None, **kwargs) → ndarray

Infer sensitive attributes from the targeted estimator. This method should be overridden by all concrete inference attack implementations.

Return type

ndarray

Parameters

  • x (ndarray) – An array with reference inputs to be used in the attack.

  • y – Labels for x. This parameter is only used by some of the attacks.

Returns

An array holding the inferred attribute values.

Base Class Reconstruction Attacks

class art.attacks.ReconstructionAttack(estimator)

Abstract base class for reconstruction attack classes.

abstract reconstruct(x: ndarray, y: Optional[ndarray] = None, **kwargs) → Tuple[ndarray, ndarray]

Reconstruct the training dataset of and from the targeted estimator. This method should be overridden by all concrete inference attack implementations.

Return type

Tuple

Parameters

  • x (ndarray) – An array with known records of the training set of estimator.

  • y – An array with known labels of the training set of estimator, if None predicted labels will be used.

Returns

A tuple of two arrays for the reconstructed training input and labels.

set_params(**kwargs) → None

Take in a dictionary of parameters and applies attack-specific checks before saving them as attributes.