Adversarial Robustness Toolbox (ART) Guide

Machine learning teams ship image, tabular, audio and detection models with accuracy figures but no evidence of how those models behave under deliberate manipulation, and that gap is where evasion, poisoning, extraction and inference attacks succeed. The Adversarial Robustness Toolbox (ART) is an open-source Python library, hosted by the LF AI & Data Foundation, that lets defenders run those attacks against their own models in a controlled way, apply defences and measure the result. This guide explains how ART is organised, the evaluation workflows it supports, how to run it safely and how to turn its outputs into hardening decisions and metrics. It is for ML engineers, AI red teams and model risk reviewers working on predictive models. The attack theory itself is covered in the Adversarial Examples and Evasion Attacks Guide; this page is about the tool.

This is an independent guide from NHI Mgmt Group, based on ART's public documentation as of November 2026. It is not sponsored or reviewed by the ART project or LF AI & Data. Features change, so confirm settings against ART's current documentation.

Key takeaways

Four threat families in one library. ART implements evasion, poisoning, extraction and inference attacks, so one harness can test a model against all four ATLAS technique areas.
Estimators make it framework-agnostic. You wrap a PyTorch, TensorFlow, Keras, scikit-learn, XGBoost, LightGBM, CatBoost or black-box model in an ART estimator, and every attack and defence works against that wrapper.
Defences come in five types. Preprocessors, postprocessors, trainers, transformers and detectors, from feature squeezing and spatial smoothing to adversarial training and Neural Cleanse.
Measure, do not just attack. Robustness metrics (CLEVER, empirical robustness, loss sensitivity), randomised smoothing certification and privacy metrics (PDTP, SHAPr) turn experiments into numbers you can track.
Mature open governance. IBM contributed ART to LF AI & Data in June 2020, it is now a graduated project (LF AI & Data announced the graduation in May 2022), and it is released under the MIT licence.

What the tool does

ART describes itself as a Python library for machine learning security that helps developers and researchers evaluate, defend, certify and verify models against adversarial threats, for both red and blue team work. It covers images, tables, audio and video, and tasks including classification, object detection, speech recognition and generation. It is installed from PyPI with pip install adversarial-robustness-toolbox; framework support is added with extras such as [pytorch], [tensorflow] or [all], because the core package does not pull in deep learning frameworks.

Library structure

Module	Purpose	Representative contents (from the ART wiki and API docs)
`art.estimators`	Wrap models so attacks and defences can query predictions and gradients	`PyTorchClassifier`, `KerasClassifier`, `BlackBoxClassifier`; object detection (Faster R-CNN, YOLO), speech recognition, regression and certification estimators
`art.attacks.evasion`	Craft inputs that cause misclassification at inference	White box: Fast Gradient Method, PGD, Auto-PGD, Carlini and Wagner, DeepFool. Black box: Square Attack, HopSkipJump, SimBA, ZOO, Boundary Attack
`art.attacks.poisoning`	Corrupt training data or plant backdoors	Backdoor, Clean-Label Backdoor, Hidden Trigger Backdoor, Sleeper Agent, poisoning attack on SVMs
`art.attacks.extraction`	Replicate a model through its query interface	Copycat CNN, KnockoffNets, Functionally Equivalent Extraction
`art.attacks.inference`	Infer membership, attributes or training data	Membership Inference Black-Box, Label-Only Gap Attack, Attribute Inference, MIFace model inversion, Database Reconstruction
`art.defences`	Reduce attack success	Preprocessor, postprocessor, trainer, transformer and detector defences (see below)
`art.metrics`	Quantify robustness and privacy	`empirical_robustness`, `clever_u`, `clever_t`, `loss_sensitivity`, `PDTP`, `SHAPr`

Estimator constructors take parameters that shape every test: clip_values sets the valid input range, preprocessing captures normalisation, and preprocessing_defences and postprocessing_defences attach defences so attacks are evaluated against the defended model.

Defender use cases

Mapping ART to threats and controls

Threat (MITRE ATLAS)	ART attack modules to test with	ART defences and metrics to evaluate	Related guide
AML.T0015 Evade AI Model; AML.T0043 Craft Adversarial Data	Evasion: PGD, Auto-PGD, Square Attack, HopSkipJump	Adversarial training (Madry's protocol), spatial smoothing, feature squeezing; empirical robustness, CLEVER, randomised smoothing	Adversarial Examples and Evasion Attacks Guide
AML.T0020 Training Data Poisoning	Poisoning: backdoor and clean-label backdoor attacks	Activation clustering detection, spectral signatures, data provenance, Neural Cleanse, STRIP	AI Data Poisoning and Backdoors Guide
AML.T0024.002 Extract AI Model	Extraction: Copycat CNN, KnockoffNets	Postprocessors: Reverse Sigmoid, Rounding, Class Labels, High Confidence, Random Noise	Model Extraction and Distillation Defence Guide
AML.T0024.000 Infer Training Data Membership	Inference: Membership Inference Black-Box, Label-Only Gap Attack	PDTP and SHAPr privacy metrics; DP-InstaHide training	Membership Inference Attacks
AML.T0024.001 Invert AI Model	Inference: MIFace, attribute inference	Output obfuscation postprocessors	Adversarial ML Taxonomy Guide

Pre-release robustness testing: attack a candidate model at several perturbation budgets and record accuracy under attack beside clean accuracy. This is evidence for ATLAS AML.M0008 Validate AI Model.
Defence selection: run the same attack against the undefended and defended estimator to measure what a preprocessor or adversarial training actually buys, at what cost to clean accuracy.
Training data assurance: run poisoning detectors over a dataset from an external or crowd-sourced source before training, supporting AML.M0007 Sanitize Training Data.
Privacy review: score per-record membership risk with SHAPr or PDTP before a model trained on personal data is exposed through an API.
API exposure decisions: test how much an extraction attack recovers when the API returns full probabilities versus labels only, then choose the output format.

Deployment and safe use

ART runs locally against models you own. It is a testing library, and the safe use rules are about authorisation, data handling and reproducibility.

Get authorisation and scope. Test only models your organisation owns or has written permission to test. Black-box attacks against a third-party API can violate its terms of service and generate large query volumes.
Isolate the environment. Install ART and its framework extras in a dedicated virtual environment or the project's Docker build, with pinned versions. Confirm the current release on the GitHub repository before pinning.
Use copies, not production artefacts. Load a copy of the model weights and a test split. Poisoning experiments create backdoored datasets and models: label them clearly, keep them out of model registries and delete them after the test.
Protect training data. Inference attacks are designed to reveal training records. Run them only where the tester is already allowed to see that data, and treat outputs as sensitive.
Start with the example scripts. The repository's examples/ folder has a minimal example per framework and notebooks/ has detailed tutorials. Reproduce one on your framework before adapting it.
Wrap the model correctly. Set clip_values and preprocessing to match production input handling; a mismatch produces misleading robustness figures.
Fix seeds and record parameters. Log attack name, norm, perturbation budget, iterations and library version with every result so the test can be rerun after a change.
Roll back safely. If a defence lowers clean accuracy beyond the agreed tolerance, revert to the previous model version and record why. Our recommendation at NHI Mgmt Group: agree that tolerance with the model owner before testing.

Pipelines that pull ART, framework packages and pretrained weights are part of your software supply chain. Pin dependencies and verify sources as described in the OWASP LLM Top 10 LLM03 Supply Chain Guide.

Detection and hardening value

Choosing a defence type

ART defence type	When it fits	Trade-off to measure
Preprocessor (feature squeezing, spatial smoothing, JPEG compression)	Quick protection for an existing model without retraining	Our view at NHI Mgmt Group: adaptive attacks that account for the preprocessor may still succeed, so retest with them
Trainer (adversarial training, Madry's protocol, certified adversarial training)	Models in high-risk decisions where retraining is acceptable	Training cost and possible clean accuracy loss
Postprocessor (Reverse Sigmoid, Rounding, Class Labels)	Models exposed through an API where extraction or inference is the concern	Less information for legitimate consumers of scores
Transformer (Neural Cleanse, STRIP, defensive distillation)	Suspected backdoors in a trained model	Compute cost; confirm with poisoning detectors
Detector (activation analysis, spectral signatures, input detectors)	Screening datasets or flagging suspicious inputs at runtime	False positive rate on normal traffic

Report results as curves, not single numbers: robust accuracy plotted against perturbation budget shows where a defence stops helping, and a defence that only works at one budget is fragile. Our recommendation at NHI Mgmt Group is to include at least one black-box attack, such as Square Attack or HopSkipJump, in every suite, because white-box gradient attacks alone can overstate robustness when a defence masks gradients.

Small teams should start with evasion testing and one preprocessor or postprocessor on their highest-impact model. Larger programmes can build an ART harness into model CI that runs a fixed attack suite on every retrain and blocks release when robustness drops.

Metrics to track

Robust accuracy: accuracy under a fixed attack and perturbation budget, per model version.
Empirical robustness: average minimal perturbation needed for misclassification; higher is better.
Clean accuracy cost: change in clean accuracy after each defence is applied.
Membership leakage: share of training records with a SHAPr score above zero.
Extraction fidelity: agreement between a stolen surrogate model and the original at a fixed query budget.
Coverage: share of production models with a current ART test report.

Framework mapping

Framework	Reference	How ART testing supports it
MITRE ATLAS mitigations	AML.M0003 Predictive AI Model Hardening; AML.M0002 Predictive AI Output Obfuscation; AML.M0015 Predictive AI Adversarial Input Detection	Trainers, postprocessors and detectors implement these mitigations; attacks verify them
NIST SP 800-53 Rev. 5	SA-11 Developer Testing and Evaluation; RA-3 Risk Assessment	Test reports evidence model testing and inform AI risk assessments
NIST CSF 2.0	ID.RA-01	Weaknesses found by attacks are identified, validated and recorded

The threat taxonomy behind these categories is set out in NIST AI 100-2; see the Adversarial ML Taxonomy Guide.

Alternatives

ART focuses on predictive models and classical adversarial ML. Related needs are served by other approaches:

LLM and agent evaluation frameworks: for prompt injection, jailbreak and agent safety testing of generative models, use an evaluation framework with sandboxed tool execution. See the Inspect AI Guide.
Framework-specific robustness libraries: some deep learning ecosystems offer their own adversarial example and certification utilities, useful when a team works in one framework only.
Formal verification tools: for small, safety-critical networks where provable bounds matter more than empirical attack results.
Managed AI red teaming services: for organisations without in-house ML security expertise. The AI Red Teaming and Testing Tools Buyer's Guide sets out evaluation criteria.

Practitioner checklist

Confirm written authorisation and scope before testing any model.
Install ART with pinned versions in an isolated environment, with only the framework extras you need.
Wrap models with clip_values and preprocessing that match production.
Test each relevant family: evasion, poisoning, extraction and inference.
Evaluate defences against adaptive attacks, not only the attack they were tuned for.
Record robust accuracy, empirical robustness and clean accuracy cost per model version.
Score membership risk with SHAPr or PDTP for models trained on personal data.
Keep poisoned datasets and backdoored models out of registries and delete them after tests.
Add a fixed ART attack suite to model CI for high-impact models.

Adversarial Robustness Toolbox Guide: Testing ML Model Defences