Skip to main content
Join the official 2020 Python Developers SurveyStart the survey!

Adversarial Attacks for PyTorch

Project description


This is a lightweight repository of adversarial attacks for Pytorch.

Torchattacks is a PyTorch library that contains adversarial attacks to generate adversarial examples and to verify the robustness of deep learning models.

Table of Contents

  1. Usage
  2. Attacks and Papers
  3. Documentation
  4. Contribution
  5. Recommended Sites and Packages


:clipboard: Dependencies

  • torch 1.2.0
  • python 3.6

:hammer: Installation

  • pip install torchattacks or
  • git clone
import torchattacks
atk = torchattacks.PGD(model, eps = 8/255, alpha = 2/255, steps=4)
adversarial_images = atk(images, labels)

:warning: Precautions

  • All images should be scaled to [0, 1] with transform[to.Tensor()] before used in attacks. To make it easy to use adversarial attacks, a reverse-normalization is not included in the attack process. To apply an input normalization, please add a normalization layer to the model. Please refer to the demo.

  • All models should return ONLY ONE vector of (N, C) where C = number of classes. Considering most models in torchvision.models return one vector of (N,C), where N is the number of inputs and C is thenumber of classes, torchattacks also only supports limited forms of output. Please check the shape of the model’s output carefully.

  • torch.backends.cudnn.deterministic = True to get same adversarial examples with fixed random seed. Some operations are non-deterministic with float tensors on GPU [discuss]. If you want to get same results with same inputs, please run torch.backends.cudnn.deterministic = True[ref].

Attacks and Papers

Implemented adversarial attacks in the papers.

The distance measure in parentheses.

  • Explaining and harnessing adversarial examples (Dec 2014): Paper
    • FGSM (Linf)
  • DeepFool: a simple and accurate method to fool deep neural networks (Nov 2015): Paper
    • DeepFool (L2)
  • Adversarial Examples in the Physical World (Jul 2016): Paper
    • BIM or iterative-FSGM (Linf)
  • Towards Evaluating the Robustness of Neural Networks (Aug 2016): Paper
    • CW (L2)
  • Ensemble Adversarial Traning: Attacks and Defences (May 2017): Paper
    • RFGSM (Linf)
  • Towards Deep Learning Models Resistant to Adversarial Attacks (Jun 2017): Paper
    • PGD (Linf)
  • Boosting Adversarial Attacks with Momentum (Oct 2017): Paper
  • Theoretically Principled Trade-off between Robustness and Accuracy (Jan 2019): Paper
    • TPGD (Linf)
  • Comment on "Adv-BNN: Improved Adversarial Defense through Robust Bayesian Neural Network" (Jul 2019): Paper
    • APGD or EOT + PGD (Linf)
  • Fast is better than free: Revisiting adversarial training (Jan 2020): Paper
    • FFGSM (Linf)
Clean Adversarial


:book: ReadTheDocs

Here is a documentation for this package.

:bell: ​Citation

If you want to cite this package, please use the following BibTex:

  title={Torchattacks: A Pytorch Repository for Adversarial Attacks},
  author={Kim, Hoki},
  journal={arXiv preprint arXiv:2010.01950},

:rocket: Demos

  • White Box Attack with Imagenet (code, nbviewer): Using torchattacks to make adversarial examples with the Imagenet dataset to fool Inception v3.
  • Black Box Attack with CIFAR10 (code, nbviewer): This demo provides an example of black box attack with two different models. First, make adversarial datasets from a holdout model with CIFAR10 and save it as torch dataset. Second, use the adversarial datasets to attack a target model.
  • Adversairal Training with MNIST (code, nbviewer): This code shows how to do adversarial training with this repository. The MNIST dataset and a custom model are used in this code. The adversarial training is performed with PGD, and then FGSM is applied to evaluate the model.

:anchor: Update Records

Update records can be found in here.


Contribution is always welcome! Use pull requests :blush:

Recommended Sites and Packages

Project details

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Files for torchattacks, version 2.6
Filename, size File type Python version Upload date Hashes
Filename, size torchattacks-2.6-py3-none-any.whl (19.3 kB) File type Wheel Python version py3 Upload date Hashes View

Supported by

Pingdom Pingdom Monitoring Google Google Object Storage and Download Analytics Sentry Sentry Error logging AWS AWS Cloud computing DataDog DataDog Monitoring Fastly Fastly CDN DigiCert DigiCert EV certificate StatusPage StatusPage Status page