Baidu’s open-source kit for adversarial AI red teaming

What it does

AdvBox Family is Baidu’s collection of AI security tools. It generates adversarial examples that trick neural networks built in PaddlePaddle, PyTorch, TensorFlow, and several other frameworks; detects adversarial input at scale; and includes data-poisoning utilities. The project also packages real-world attack scenarios—such as face-recognition bypasses and a “stealth T-shirt” that disappears from smart cameras—into standalone demonstrations.

The interesting bit

The project is battle-tested: its researchers have presented at Black Hat Asia, DEF CON China, and HITB, and the toolkit includes a command-line utility that claims to generate adversarial examples without writing code. It is inspired by FoolBox v1 but casts a wider net across frameworks and applications.

Key highlights

• Supports adversarial generation across PaddlePaddle, PyTorch, Caffe2, MxNet, Keras, and TensorFlow
• Includes AdvDetect for spotting adversarial examples in large datasets and AdvPoison for data-poisoning attacks
• Bundles applied demos: face-recognition attacks, a stealth T-shirt that evades smart cameras, and a RESTful API for fake-face detection
• Command-line tool in AdversarialBox offers a “Zero-Coding” route to generating examples
• Apache 2.0 licensed and actively cited in academic work (IEEE S&P, ICCV, EACL)

Caveats

• The README lists AdvPoison as merely “Data poisoning” with no further detail, so its scope and maturity are unclear
• “Zero-Coding” generation applies specifically to the AdversarialBox sub-tool, not the entire family
• The project page leans heavily on past conference talks; current development velocity and maintenance status are not obvious from the README

Verdict

Security researchers and AI red teams who need a broad, framework-agnostic starting point for adversarial attacks—and who value working demos over polished APIs—should look here. Production engineers seeking a single, tightly integrated library may find the family structure too fragmented.