Interactive tool
Attack Selector
Describe the model access, modality, adversary goal, and defenses in place. Get a ranked, filtered shortlist of the adversarial-ML attacks that are actually feasible against that setup — each with its access requirement, compute/query budget, transferability, the canonical paper, and a reference implementation.
Constraint-driven: an attack is shown only when its access requirement is satisfiable and it is applicable to your modality and goal. Defenses you mark present push the attacks they actually counter down the ranking (and flag the adaptive attack that beats them). 38 attacks catalogued · reviewed 2026-05.
Full attack catalogue
| Attack | Family | Access | Goal | Refs |
|---|---|---|---|---|
| FGSM (Fast Gradient Sign Method) | Evasion · gradient | white-box | evasion | paper · repo |
| PGD (Projected Gradient Descent) | Evasion · gradient | white-box | evasion | paper · repo |
| C&W (Carlini & Wagner L2) | Evasion · optimization | white-box | evasion | paper · repo |
| AutoAttack | Evasion · ensemble | white-box | evasion | paper · repo |
| DeepFool | Evasion · optimization | white-box | evasion | paper · repo |
| JSMA (Jacobian Saliency Map Attack) | Evasion · gradient (L0) | white-box | evasion | paper · repo |
| BIM / I-FGSM (Basic Iterative Method) | Evasion · gradient | white-box | evasion | paper · repo |
| MI-FGSM (Momentum Iterative) | Evasion · transfer | white-box | evasion | paper · repo |
| HopSkipJump | Evasion · decision-based | black-box-labels | evasion | paper · repo |
| Boundary Attack | Evasion · decision-based | black-box-labels | evasion | paper · repo |
| Square Attack | Evasion · score-based | black-box-logits | evasion | paper · repo |
| ZOO (Zeroth-Order Optimization) | Evasion · score-based | black-box-logits | evasion | paper · repo |
| NES / Bandits (query-limited black-box) | Evasion · score-based | query-limited | evasion | paper · repo |
| Sign-OPT / OPT-attack | Evasion · decision-based | black-box-labels | evasion | paper · repo |
| SPSA | Evasion · score-based | black-box-logits | evasion | paper · repo |
| EOT (Expectation over Transformation) | Evasion · robust perturbation | white-box | evasion | paper · repo |
| BPDA (Backward Pass Differentiable Approx.) | Evasion · adaptive | white-box | evasion | paper · repo |
| Universal Adversarial Perturbation (UAP) | Evasion · universal | white-box | evasion | paper · repo |
| Adversarial Patch | Evasion · physical | white-box | evasion | paper · repo |
| DPatch / object-detector patch | Evasion · physical (detection) | white-box | evasion | paper · repo |
| TextFooler | Evasion · NLP (word-level) | black-box-logits | evasion | paper · repo |
| BERT-Attack | Evasion · NLP (MLM-guided) | black-box-logits | evasion | paper · repo |
| GCG (Greedy Coordinate Gradient suffix) | Evasion · LLM jailbreak | white-box | evasion | paper · repo |
| AutoDAN | Evasion · LLM jailbreak | white-box | evasion | paper · repo |
| PAIR (Prompt Automatic Iterative Refinement) | Evasion · LLM jailbreak (black-box) | query-limited | evasion | paper · repo |
| Training-data poisoning (label flipping / clean-label) | Poisoning · availability/integrity | black-box-labels | poisoning | paper · repo |
| BadNets (backdoor / trojan trigger) | Poisoning · backdoor | black-box-labels | poisoning | paper · repo |
| Model extraction (functionality stealing) | Extraction | black-box-logits | extraction | paper · repo |
| Knockoff Nets | Extraction | black-box-logits | extraction | paper · repo |
| Model Inversion | Inversion · privacy | black-box-logits | inversion | paper · repo |
| GAN-guided / GMI Model Inversion | Inversion · privacy | white-box | inversion | paper · repo |
| Membership Inference (shadow-model) | Membership inference · privacy | black-box-logits | membership-inference | paper · repo |
| LiRA (Likelihood Ratio MIA) | Membership inference · privacy | black-box-logits | membership-inference | paper · repo |
| Training-data extraction (LLM memorization) | Inversion · LLM privacy | black-box-labels | inversion, membership-inference | paper · repo |
| Bullseye Polytope (transfer-learning poisoning) | Poisoning · clean-label | white-box | poisoning | paper · repo |
| Witches' Brew (gradient-matching poisoning) | Poisoning · clean-label (from-scratch) | white-box | poisoning | paper · repo |
| Audio adversarial examples (targeted ASR) | Evasion · audio | white-box | evasion | paper · repo |
| Visual prompt injection (VLM image jailbreak) | Evasion · multimodal jailbreak | white-box | evasion | paper · repo |