Counterfit

Counterfit is a Microsoft open-source command-line tool that automates security assessment of machine learning models, with 943 stars on GitHub.

Overview

Counterfit, from Microsoft’s Azure team, is a generic automation layer for assessing the security of machine learning systems. It brings several existing adversarial machine learning frameworks together under one consistent command-line interface, so red teams and ML engineers can run attacks against their own models without learning a new tool for every framework. Users can also plug in their own attacks and targets. The goal is to make adversarial testing — evasion attacks, poisoning checks and related probes — a routine part of shipping an ML system rather than a specialist research exercise. The project is MIT-licensed and was still receiving updates in 2025. The tool ships with ready-made target environments and example attacks, so you can point it at an image classifier, a text model or an API-backed system and immediately start probing how it behaves under adversarial pressure.

Key Features

• One CLI unifying multiple adversarial ML frameworks
• Run evasion and other attacks against your own models and APIs
• Extensible: add custom attacks, targets and environments
• Interactive command-line environment for exploratory testing
• Covers models across common frameworks and deployment styles
• Built by Microsoft’s AI red team tooling community
• Free and open source under the MIT license

💳 Pricing

Counterfit is completely free and open source under the MIT license. There is no commercial tier; it is a community security tool you install and run against systems you own or are authorised to test.

Who Is It For

Counterfit is for ML engineers, security teams and red teamers who deploy machine learning models and need to know how they hold up under adversarial pressure before attackers find out. It fits organisations building an AI security testing practice and researchers comparing attack frameworks through a single interface.