evasion-and-preprocessing

# Evasion and preprocessing Use this sub-skill when the task is to generate evasion adversarial examples, select a white-box/black-box/physical image attack, add preprocessing defences, or plan adversarial training with ART estimators. ## Route here - Craft FGSM/FGM, PGD/BIM/MIM/AutoPGD/AutoAttack, Carlini, DeepFool, ElasticNet, JSMA, universal perturbation, virtual adversarial, HopSkipJump, Boundary, ZOO, SimBA, Square, Pixel/Threshold, SignOPT, DecisionTree, spatial, feature-adversary, or image-patch attacks. - Add image/tabular preprocessing defences such as standardisation, spatial smoothing, feature squeezing, JPEG compression, Gaussian augmentation, label smoothing, Mixup, CutMix, Cutout, thermometer encoding, total variation minimization, or PixelDefend. - Plan adversarial training with `AdversarialTrainer`, `AdversarialTrainerMadryPGD`, or TRADES-style trainers. ## Route away - Model wrapping, `clip_values`, `input_shape`, backend device setup, and estimator construction details belong to `../estimators-and-models/` or `../setup-and-backends/`. - Poisoning, backdoors, membership/attribute inference, model inversion, or model extraction belong to `../poisoning-inference-extraction/`. - Robustness metrics, certification, tree verification, security curves, and gradient checks after attack generation belong to `../evaluation-and-certification/`. - Speech, object-detection-heavy, malware, and audio-heavy evasion workflows are outside this selected runtime scope unless a future refresh adds their required backends. Recognize their ART class names, but do not promise runnable coverage here. ## Operating sequence 1. Confirm the estimator capability: loss gradients for PGD/FGM/BIM/MIM/AutoPGD, class gradients for Carlini/DeepFool/JSMA-style attacks, prediction-only classifiers for hard-label black-box attacks, or neural-network/image-specific support for patch/spatial attacks. 2. Match all perturbation budgets to the estimator input scale and `clip_values`; for normalized `[0, 1]` images use budgets such as `8/255`, not `8`. 3. Check shape conventions before running an attack: PyTorch image estimators usually use `channels_first=True` and `NCHW`; many NumPy image preprocessors default to `channels_first=False` and `NHWC`. 4. For targeted attacks, pass target labels as `y` to `generate`; use one-hot labels unless the wrapped estimator workflow explicitly uses class-index labels. 5. Add preprocessing defences either directly as callable preprocessors or through estimator `preprocessing_defences`; do not treat preprocessing alone as proof of robustness. 6. For adversarial training, start from a bounded PGD/FGM attack, verify labels and clipping, then choose generic, Madry PGD, or TRADES training according to the estimator backend. ## References - Attack family/API chooser: [references/attack-api-reference.md](references/attack-api-reference.md) - Preprocessing and adversarial training recipes: [references/preprocessing-and-training.md](references/preprocessing-and-training.md) - Evasion/preprocessing troubleshooting: [references/troubleshooting.md](references/troubleshooting.md) ## Bundled checks - Tiny CPU PyTorch PGD/FGM smoke: [scripts/smoke_evasion_pytorch.py](scripts/smoke_evasion_pytorch.py) - Tiny NumPy standardisation/spatial smoothing smoke: [scripts/smoke_preprocessor_numpy.py](scripts/smoke_preprocessor_numpy.py) Run bundled scripts with `--help` first; they use synthetic data and do not download datasets.