advertorch v0.1: An Adversarial Robustness Toolbox based on PyTorch

Abstract: advertorch is a toolbox for adversarial robustness research. It contains various implementations for attacks, defenses and robust training methods. advertorch is built on PyTorch (Paszke et al., 2017), and leverages the advantages of the dynamic computational graph to provide concise and efficient reference implementations. The code is licensed under the LGPL license and is open sourced at https://github.com/BorealisAI/advertorch .

• The paper presents advertorch v0.1 as a comprehensive adversarial robustness toolbox that simplifies gradient-based attack and defense implementations using intuitive PyTorch APIs.
• It offers efficient reference implementations, including BPDA wrappers, that enhance the flexibility and effectiveness of gradient-based adversarial strategies.
• The toolbox supports reproducible research with modular defenses and Semantic Versioning, paving the way for robust adversarial training and comparative studies.

An Overview of "v0.1: An Adversarial Robustness Toolbox based on PyTorch"

The paper by Gavin Weiguang Ding, Luyu Wang, and Xiaomeng Jin presents a toolbox for adversarial robustness research, leveraging the PyTorch framework. This toolbox provides an array of implementations for attacks, defenses, and robust training methodologies, aiming to facilitate research into machine learning models' adversarial vulnerabilities.

Key Features and Components

This toolbox distinguishes itself through several key features, optimally harnessing the dynamic computational graphs in PyTorch:

1. Simple and Consistent APIs: The toolbox is designed with straightforward APIs for both attacks and defenses, ensuring ease of use and integration into broader research efforts.
2. Concise Implementations: Utilizing PyTorch's capabilities, the toolbox provides efficient reference implementations that support swift execution, particularly crucial for attack-in-the-loop algorithms such as adversarial training.
3. Comprehensive Attack Implementations: A primary focus of the toolbox is on gradient-based attacks. Notable implementations include:
   • GradientAttack, GradientSignAttack
   • L2BasicIterativeAttack, LinfBasicIterativeAttack
   • LinfPGDAttack, L2PGDAttack
   • CarliniWagnerL2Attack, among others

Each attack methodology encompasses three components: a predict function, a loss function, and a perturb method. This structure facilitates flexibility and extensibility in designing adversarial attacks, allowing for variations in the predict and loss functions to achieve diverse objectives.

1. BPDA Wrapper: The inclusion of Backward Pass Differentiable Approximation (BPDA) functionality allows the toolbox to enhance gradient-based attacks when addressing models with non-differentiable defenses. This adaptability highlights the robustness of attack strategies implemented within this framework.

Defenses and Robust Training

The toolbox also integrates several preprocessing-based defense mechanisms, such as JPEGFilter and BitSqueezing, implemented as PyTorch modules. This modularity aids in dynamically composing defenses according to research needs.

For robust training, adversarially augmented training and provably robust training approaches are considered, though the paper acknowledges the non-standardized nature of these methods. An illustrative implementation of adversarial training on the MNIST dataset is provided, contributing valuable practical insights.

Versioning and Usage

Adhering to Semantic Versioning 2.0.0, the toolbox allows researchers to report their results accurately by specifying version numbers and detailed hyperparameters. This practice is crucial for reproducibility and comparison across different studies.

Implications and Future Directions

The toolbox serves as a robust resource for researchers exploring adversarial machine learning, providing foundational tools to explore the vulnerabilities and defenses of ML models. Its integration with PyTorch ensures accessibility and extensibility, paving the way for further innovation in adversarial robustness. Future developments could see enhancements in defense methodologies and further standardization of robust training algorithms, contributing significantly to theoretical and practical advancements in AI safety.

Overall, this toolbox represents a substantial contribution to the domain, offering researchers a practical platform to advance their adversarial robustness investigations.