Version 1.3.2

Fixed assertions that prevented custom preprocessing functions from changing the shape of the input (see #187).

Version 1.3.1

New Features

• added the EvoluationaryStrategiesGradientEstimator as an alternative to the CoordinateWiseGradientEstimator introduced in 1.3.0 (thanks to @lukas-schott)

Version 1.3.0

Highlights

• added support for arbitrary preprocessing functions with custom gradients (e.g. input binarization with a straight-through approximation in the backward pass)
• added the ModelWithEstimatedGradients model wrapper to replace a model's gradients with gradients estimated by an arbitrary gradient estimator
• added the CoordinateWiseGradientEstimator and an easy template to implement custom gradient estimators
• added the BinarizationRefinementAttack that uses information about a model's input binarization to refine adversarials found by other attacks
• added the ConfidentMisclassification criterion

Other improvements

• added a binarize function in in utils to provide a consistent way to specify input binarization as part of the preprocessing
• added batch_crossentropy in utils
• added preprocessing support to LasagneModel
• renamed the GradientLess model wrapper to ModelWithoutGradients
• bug fixes
• improved documentation and fixed typos

Version 1.2.0

Highlights

• Basic Iterative Method reimplemented (Linfinity, L1, L2)
  • recommended instead of IterativeGradientAttack and IterativeGradientSignAttack
• Projected Gradient Descent attack (with and without random start)
• Momentum Iterative Method
• full PyTorch 0.4.0 support (thanks @cjsg)
• new MXNetGluonModel wrapper for Gluon models (thanks @meissnereric)

Other improvements

• official PyTorch example in the docs
• bug fixes
• updated tests to use newer versions of the different frameworks
• improved documentation and fixed typos

Version 1.1.0

• added the PointwiseAttack (supersedes the ResetAttack)
• attacks now provide the full function signature of their __call__ method as well as parameter documentation
• added additional checks for correctness of the returned adversarials even when attacks misbehave
• replaced the randomstate package with the randomgen package
• bug fixes and improvements

Version 1.0.0

Improved the documentation and the availability of useful function signatures. Attack parameters are now be fully documented, like everything else, and this documentation is directly accessible within Jupyter / IPython and IDEs.

Version 0.15.0

• fixed CompositeModel and added it to docs
• added L0 and Linfinity (Linf) distance measures
• added DeepFoolLinfinityAttack
• renamed DeepFoolAttack to DeepFoolL2Attack
• new DeepFoolAttack now chooses norm to optimize based on the employed distance measure (alternative, p=2 or p=np.inf can be passed)
• fixed integer overflows caused by numpy
• improved tests

Version 0.14.0

Fixed a numeric issue when attacking Keras models that provide probability outputs (instead of logits) using a gradient-based attack.

Version 0.13.0

Fixed package dependency issues.

Version 0.12.4

• Improved GradientAttack and GradientSignAttack (FGSM) to handle smaller epsilons
• fixed Pillow imports
• improved README rendering on PyPI
• other minor changes