Benchmarking How Fast Your Neural Net Falls Over

What it does

CleverHans is a Python library of reference implementations for adversarial attacks and defenses, designed to help researchers benchmark how vulnerable machine learning models are to manipulated inputs. Since version 4.0.0, the codebase supports JAX, PyTorch, and TensorFlow 2, with each framework living in its own subdirectory under cleverhans/, defenses/, and tutorials/.

The interesting bit

The project borrows its name from Clever Hans, a horse that seemed to solve arithmetic by reading subtle human cues rather than actually understanding math. The authors use it as a deliberate metaphor for ML systems that ace test sets but collapse when the inputs are adversarially shifted.

Key highlights

• Reference implementations of attacks like FGSM and PGD for consistent, reproducible benchmarking
• Tri-framework support: JAX, PyTorch, and TF2, though PyTorch attack contributions are currently prioritized
• Tutorials are continuously integration tested but explicitly not part of the stable API
• Maintained by the CleverHans Lab at the University of Toronto; previously led by Ian Goodfellow and Nicolas Papernot
• Academic use is encouraged to cite the project’s arXiv technical report

Caveats

• The examples/ directory is currently empty following the removal of TF1 support
• Tutorials can change without warning and should not be imported as third-party dependencies
• The library focuses on benchmarking and reference implementations rather than turnkey model hardening

Verdict

ML security researchers who need standardized, cross-framework attack benchmarks should keep this handy; engineers seeking a drop-in defense wrapper or stable tutorial interface may find the API boundaries too porous.