ART 1.16.0

[beat-buesser]

This release of ART 1.16.0 introduces multiple estimators for certified robustness and Hugging Face models, adversarial training with Adversarial Weight Perturbation, improvements for inference attacks, and more.

Added

• Added estimator for smoothed vision transformers as defence against evasion with adversarial patches (Implement smoothed Vision Transformer as defense against patch evasion attacks #2171)
• Added estimators for variations of randomised smoothing including MACER, SmoothAdv, and SmoothMix for PyTorch and TensorFlow (Randomized Smoothing Variations Implementation #2218)
• Added adversarial training with Adversarial Weight Perturbation protocol in PyTorch (adding adversarial weight perturbation protocol #2224)
• Added estimator for Hugging Face models with PyTorch backend (Implement estimator for Hugging Face models #2245)
• Added ObjectSeeker certifiably robust defence for object detectors against poisoning and adversarial patches (ObjectSeeker Defense Implementation #2246)
• Added representation string __repr__ to all attacks (Printable representation of Attack objects [JATIC-I2-IBM] #2274)

Changed

• Changed inference attacks to support additional attack model types (e.g., KNN, LR, etc.) and replaced scikit-learn's MLPClassifier with a PyTorch neural network model (Improve attack model types in inference attacks #2253)
• Changes attacks's method set_params to raise ValueError if a not previously defined attributed is set (AutoAttack skips attacks not supporting targeted mode [JATIC-I2-IBM] #2257)
• Changed AutoAttack to support multiprocessing and support running attacks in parallel (Parallelization support in AutoAttack [JATIC-I2-IBM] #2258)

Removed

[None]

Fixed

• Fixed docstring of TargetedUniversalPerturbation (Update Targeted Universal Perturbation documentation and add example notebook #2212)
• Fixed bug of unsupported operands because of dependency updates in AdversarialPatchTensorFlowV2 (Fix unsupported operand type(s) for / error in AdversarialPatch in Tensorflow #2276)
• Fixed bug in AutoAttack to avoid that attacks which do not support targeted mode are skipped (AutoAttack skips attacks not supporting targeted mode [JATIC-I2-IBM] #2257)

---

This discussion was created from the release ART 1.16.0.