ART 1.9.0

[beat-buesser]

This release of ART 1.9.0 introduces the first evasion attack specifically designed against object tracking applications and able to distinguish foreground and background objects, the first evasion attack against image classifiers simulating attacks with laser beams on target objects, the new Summary Writer API to collect attack internal custom metrics, a defense against general poisoning attacks and tools for shadow model training to support membership inference attacks.

Added

• Added tools for training shadow models and generating shadow-datasets in support of membership inference attacks in art.attacks.inference.membership_inference.shadow_models. (Shadow model training #1345, Introduce shadow model training for inference attacks #1395)
• Added hill-climbing synthetic data generation algorithm (Shokri et al., 2017) to train shadow models without access to actual data. (Shadow model training #1345, Introduce shadow model training for inference attacks #1395)
• Added experimental estimator for classification models in JAX in art.experimental.estimators.classification.JaxClassifier (Implement a classifier on Jax framework #1360)
• Added Deep Partition Aggregation as classification estimator in art.estimators.classification.DeepPartitionEnsemble to defend against general poisoning attacks (Implement Deep Partition Aggregation #1397)
• Added Adversarial Laser Beam attack in art.attacks.evasion.LaserAttack as a easy to realize physical evasion attack (add adversarial laser beam attack and tests #1398)
• Added customizable Summary Writer API in art.summary_writer.SummaryWriter to collect attack internal metrics in supported attacks providing collected metrics in TensorBoard format for analysis (Implement customizable summary writer and indicators of attack failure #1416 )
• Added Indicators of Attack Failure (Pintor et al., 2021) as metrics in default summary writer art.summary_writer.SummaryWriterDefault (Implement customizable summary writer and indicators of attack failure #1416)
• Added Adversarial Texture Attack against object tracking models in art.attacks.evasion.AdversarialTexturePyTorch. The attack distinguishes foreground and background objects to create textures/patches that work even if partially covered. (Implement Adversarial Texture Attack on Object Trackers #1430)

Changed

• Changed implementation of Carlini & WAgner L_inf attack in art.attacks.evasion.CarliniLInfMethod to exactly reproduce performance of reference implementation (Updates for CarliniLInfMethod attack #1380)
• Changed art.defences.preprocessor.preprocessor.PreprocessorPyTorch to accept device_type in __init__ to set attribute _device for all PyTorch preprocessors in a single location (Set _device parameter automatically in PreprocessorPyTorch (fixes #1442) #1444)

Removed

• Removed deprecated Numpy scalar type names (Removes deprecated Numpy scalar type names #1296)
• Removed outdated comments in tests.attacks.test_simba that SimBA would not support PyTorch (Remove outdated comments in SimBA tests #1423)

Fixed

• Fixed missing support for input with more than one input image in art.attacks.evasion.SimBA.generate, so far only the first sample had been attack if more than one image was provided. (Add support for multiple samples in SimBA.generate #1422)
• Fixed art.attacks.poisoning.perturbations.insert_image to preserve dtype of input images in the returned output images (Adding type preservation to insert_image #1441)
• Fixed missing transformation of binary index to one-hot encoded labels in art.utils.check_and_transform_label_format for argument return_one_hot=True (Update check_and_transform_label_format for index labels #1443)

---

This discussion was created from the release ART 1.9.0.