Break your own models before someone else does

What it does

Torchattacks is a PyTorch library that implements a broad catalog of adversarial attack algorithms—FGSM, PGD, CW, AutoAttack, and many others—to generate adversarial examples against vision models. It exposes them through a unified, PyTorch-style interface where you instantiate an attack object and call it on your input tensors. The library also handles practical details like input normalization, targeted attack modes, and chaining multiple attacks together.

The interesting bit

The real value is not any single algorithm, but the standardization: it turns a pile of disparate research implementations into one consistent API, complete with utilities for saving adversarial datasets and toggling model train/eval states during gradient computation. That consistency is what keeps researchers from maintaining their own half-broken FGSM forks.

Key highlights

• Covers a wide range of attacks including Linf, L2, and L0 methods (FGSM, PGD, CW, DeepFool, OnePixel, AutoAttack, and others).
• Supports targeted modes (random, least-likely, custom mapping) and multi-attack wrappers for stronger ensembles.
• Handles input normalization via set_normalization_used so you don’t have to denormalize manually.
• Includes utilities to save/load adversarial example loaders and to manage model train/eval states for RNN-based architectures.
• Published and citable (arXiv:2010.01950), with links to complementary frameworks like RobustBench and MAIR.

Caveats

• Models must return exactly one (N, C) logits tensor; exotic architectures with multiple outputs are unsupported.
• Inputs are expected in the [0, 1] range, and the library clips perturbations accordingly—if your pipeline uses different scaling, you need to account for that.
• GPU reproducibility requires setting torch.backends.cudnn.deterministic = True; without it, identical seeds may yield different adversarial examples.

Verdict

Researchers and engineers actively testing adversarial robustness of PyTorch vision models will save time here. If you are not working with standard classification outputs or your data lives outside the [0, 1] range, expect friction.