Technical Report on the CleverHans v2.1.0 Adversarial Examples Library

By Nicolas Papernot, Fartash Faghri, Nicholas Carlini, Ian J. Goodfellow, Reuben Feinman, Alexey Kurakin, Cihang Xie, Yash Sharma, Tom B. Brown, Aurko Roy and 16 more. 2016

544 citations recorded by the source corpus.

CleverHans is a software library that provides standardized reference implementations of adversarial example construction techniques and adversarial training. The library may be used to develop more robust machine learning models and to provide standardized benchmarks of models' performance in the adversarial setting. Benchmarks constructed without a standardized implementation of adversarial example construction are not comparable to each other, because a good result may indicate a robust model or it may merely indicate a weak implementation of the adversarial example construction procedure. This technical report is structured as follows. Section 1 provides an overview of adversarial examples in machine learning and of the CleverHans software. Section 2 presents the core functionalities of the library: namely the attacks based on adversarial examples and defenses to improve the robustness of machine learning models to these attacks. Section 3 describes how to report benchmark results using the library. Section 4 describes the versioning system.

Subfields: Artificial Intelligence, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Safety, Robustness & Interpretability

Citations in the corpus

Adversarial Examples: Attacks and Defenses for Deep Learning (2017, background): “Cleverhans [139] and Foolbox [140] are open-source libraries to benchmark the vulnerability of DNNs against adversarial images.”
Detecting Adversarial Samples from Artifacts (2017, methodology): “Figures 7a and 7b compare the distribution of Bayesian uncertainty for adversarial samples to those of normal samples and of noisy samples with equivalent perturbation size; both the BIM and JSMA cases are shown.”
Adversarial Logit Pairing (2018, methodology): “Multiple methods to defend against adversarial examples have been proposed (Buckman et al., 2018; Goodfellow et al., 2014; Kolter & Wong, 2017; Madry et al., 2017; Papernot et al., 2016; Szegedy et al., 2013; Tramèr et al., 2018; Xu et al., 2017).”
On Evaluating Adversarial Robustness (2019, methodology): “There are several frameworks such as CleverHans (Papernot et al., 2018) or Foolbox (Rauber et al., 2017) as well as websites9,10,11 which have been developed to assist in this process.”
Foolbox v0.8.0: A Python toolbox to benchmark the robustness of machine learning models (2017, methodology): “This allows transfer attacks of the type described by Papernot et al. (2016c).”
Unlabeled Data Improves Adversarial Robustness (2019, methodology): “PGTRADES and PGMadry correspond to the attacks used in [56] and [29] respectively, and we apply the Carlini-Wagner attack CW [7] on 1,000 random test examples, where we use the implementation [34] that performs search over attack hyperparameters.”
Adversarial Attacks and Defenses in Deep Learning (2020, background): “[13,14,57,58] show that adversarial training is one of the most effective defenses against adversarial attacks.”
On Adaptive Attacks to Adversarial Example Defenses (2020, methodology): “This reminded us of distillation as a defense (Papernot et al., 2016c), which has a similar eﬀect on the logits.”
AllenNLP Interpret: A Framework for Explaining Predictions of NLP Models (2019, background): “Existing Interpretation Toolkits In computer vision, various open-source toolkits exist for explaining and attacking models (e.g., Papernot et al. (2016); Ozbulak (2019), inter alia); some toolk-its also include interactive demos (Norton and Qi, 2017).”
Defending Against Adversarial Attacks by Leveraging an Entire GAN (2018, background): “…adversarial attacks include training with adversarial samples (Goodfellow et al., 2014b), modifying the classiﬁer to make it more robust to attacks (Papernot et al., 2016), label-smoothing (Warde-Farley & Goodfellow, 2016), as well as using auxiliary networks to pre-process and clean the samples…”