Foolbox is a Python toolbox for creating adversarial examples, the subtly perturbed inputs that fool neural networks into wrong predictions, and for benchmarking how robust machine learning models really are. It runs attacks natively against models built in PyTorch, TensorFlow, and JAX from a single codebase.
Foolbox is developed by the Bethge Lab and collaborators on GitHub, where it has earned nearly 3,000 stars under the MIT license, with maintenance continuing into late 2025. Version 3 was rewritten from scratch on top of EagerPy, giving it native performance in each framework instead of forcing models through a NumPy bottleneck, together with real batch support for attacking many inputs efficiently. The library provides a large collection of state-of-the-art gradient-based and decision-based attacks, the standard arsenal for robustness evaluation, and its design emphasizes correctness, including thorough type checking, so results can be trusted in published research. Foolbox itself was published in the Journal of Open Source Software, and it has become a reference tool in the adversarial machine learning community, used to evaluate defenses, compare architectures, and generate the adversarial examples that robustness papers report. Documentation, tutorials, and examples are hosted on the project site, covering everything from a first attack on a pretrained classifier to custom robustness benchmarks. If you claim a model is robust, Foolbox is how you check.
Foolbox is completely free and open source under the MIT license. There is no commercial version; you run it against your own models on your own hardware.
Foolbox is for machine learning security researchers, robustness engineers, and academics who need to evaluate, compare, or improve the adversarial robustness of neural networks with a standard, credible toolset.