torchattack 1.1.0

A set of adversarial attacks implemented in PyTorch

---

🛡 torchattack - A curated list of adversarial attacks in PyTorch, with a focus on transferable black-box attacks.

pip install torchattack

Usage

import torch

device = torch.device('cuda' if torch.cuda.is_available() else 'cpu')

Load a pretrained model to attack from either torchvision or timm.

from torchattack import AttackModel

# Load a model with `AttackModel`
model = AttackModel.from_pretrained(model_name='resnet50', device=device)
# `AttackModel` automatically attach the model's `transform` and `normalize` functions
transform, normalize = model.transform, model.normalize

# Additionally, to explicitly specify where to load the pretrained model from (timm or torchvision),
# prepend the model name with 'timm/' or 'tv/' respectively, or use the `from_timm` argument, e.g.
vit_b16 = AttackModel.from_pretrained(model_name='timm/vit_base_patch16_224', device=device)
inv_v3 = AttackModel.from_pretrained(model_name='tv/inception_v3', device=device)
pit_b = AttackModel.from_pretrained(model_name='pit_b_224', device=device, from_timm=True)

Initialize an attack by importing its attack class.

from torchattack import FGSM, MIFGSM

# Initialize an attack
attack = FGSM(model, normalize, device)

# Initialize an attack with extra params
attack = MIFGSM(model, normalize, device, eps=0.03, steps=10, decay=1.0)

Initialize an attack by its name with create_attack().

from torchattack import create_attack

# Initialize FGSM attack with create_attack
attack = create_attack('FGSM', model, normalize, device)

# Initialize PGD attack with specific eps with create_attack
attack = create_attack('PGD', model, normalize, device, eps=0.03)

# Initialize MI-FGSM attack with extra args with create_attack
attack_args = {'steps': 10, 'decay': 1.0}
attack = create_attack('MIFGSM', model, normalize, device, eps=0.03, attack_args=attack_args)

Check out torchattack.eval.runner for a full example.

Attacks

Name	Class Name	Publication	Paper (Open Access)
Gradient-based attacks
FGSM	FGSM		Explaining and Harnessing Adversarial Examples
PGD	PGD		Towards Deep Learning Models Resistant to Adversarial Attacks
PGD (L2)	PGDL2		Towards Deep Learning Models Resistant to Adversarial Attacks
MI-FGSM	MIFGSM		Boosting Adversarial Attacks with Momentum
DI-FGSM	DIFGSM		Improving Transferability of Adversarial Examples with Input Diversity
TI-FGSM	TIFGSM		Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attacks
NI-FGSM	NIFGSM		Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attacks
SI-NI-FGSM	SINIFGSM		Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attacks
DR	DR		Enhancing Cross-Task Black-Box Transferability of Adversarial Examples With Dispersion Reduction
VMI-FGSM	VMIFGSM		Enhancing the Transferability of Adversarial Attacks through Variance Tuning
VNI-FGSM	VNIFGSM		Enhancing the Transferability of Adversarial Attacks through Variance Tuning
Admix	Admix		Admix: Enhancing the Transferability of Adversarial Attacks
FIA	FIA		Feature Importance-aware Transferable Adversarial Attacks
PNA-PatchOut	PNAPatchOut		Towards Transferable Adversarial Attacks on Vision Transformers
NAA	NAA		Improving Adversarial Transferability via Neuron Attribution-Based Attacks
SSA	SSA		Frequency Domain Model Augmentation for Adversarial Attack
TGR	TGR		Transferable Adversarial Attacks on Vision Transformers with Token Gradient Regularization
ILPD	ILPD		Improving Adversarial Transferability via Intermediate-level Perturbation Decay
DeCoWA	DeCoWA		Boosting Adversarial Transferability across Model Genus by Deformation-Constrained Warping
VDC	VDC		Improving the Adversarial Transferability of Vision Transformers with Virtual Dense Connection
Generative attacks
CDA	CDA		Cross-Domain Transferability of Adversarial Perturbations
LTP	LTP		Learning Transferable Adversarial Perturbations
BIA	BIA		Beyond ImageNet Attack: Towards Crafting Adversarial Examples for Black-box Domains
Others
DeepFool	DeepFool		DeepFool: A Simple and Accurate Method to Fool Deep Neural Networks
GeoDA	GeoDA		GeoDA: A Geometric Framework for Black-box Adversarial Attacks
SSP	SSP		A Self-supervised Approach for Adversarial Robustness

Development

# Create a virtual environment
python -m venv .venv
source .venv/bin/activate

# Install deps with dev extras
python -m pip install -r requirements.txt
python -m pip install -e ".[dev]"

License

MIT

Related

• Harry24k/adversarial-attacks-pytorch
• Trusted-AI/adversarial-robustness-toolbox