Adversarial Robustness Toolbox

The Adversarial Robustness Toolbox (ART) is a Python library for machine learning security, hosted by the Linux Foundation AI & Data Foundation. It has about 6,300 stars on GitHub and was actively maintained in 2026, currently at version 1.20.

Overview

ART gives developers and researchers one toolkit for both sides of ML security: attacking models to expose weaknesses, and defending them. It covers the four major adversarial threat families — evasion, poisoning, extraction, and inference — and works across TensorFlow, Keras, PyTorch, scikit-learn, XGBoost, LightGBM, CatBoost, GPy, and more. Attacks and defenses span all common data types (images, tables, audio, and video) and tasks from classification and object detection to speech recognition, generation, and certification. Red teams use it to probe models systematically; blue teams use the same library to apply defenses, measure robustness with standard metrics, and re-run the attacks to verify the fix. The library ships with an extensive notebook collection and documentation that walk through each attack and defense, which has made it a standard teaching tool in ML security courses as well as a benchmarking suite for published research. Contributions come from a broad community of security researchers and framework maintainers.

Key Features

• Four threat families: attacks and defenses for evasion, poisoning, extraction, and inference
• Framework agnostic: TensorFlow, Keras, PyTorch, scikit-learn, XGBoost, LightGBM, CatBoost, and more
• All data types: images, tables, audio, and video, across classification, detection, and generation tasks
• Red and blue team tooling: run attacks to probe models, then apply defenses and re-evaluate
• Certification and metrics: robustness metrics and certified defenses for measurable guarantees
• Extensible estimators: wrap your own model to benchmark it against the full attack suite

💳 Pricing

ART is completely free and open source under the MIT license, maintained as a Linux Foundation AI & Data project.

Who Is It For

ML security researchers, red and blue teams, and ML engineers who need to prove a production model can withstand adversarial pressure before — and after — deployment.