### Install AutoAttack

Source: https://github.com/fra31/auto-attack/blob/master/README.md

Use pip to install AutoAttack from its GitHub repository. This is the first step before using the library.

```bash
pip install git+https://github.com/fra31/auto-attack
```

--------------------------------

### Evaluate and Save Adversarial Examples

Source: https://context7.com/fra31/auto-attack/llms.txt

Evaluates adversarial robustness on the first 1000 samples and saves the adversarial examples along with clean data and true labels. Ensure 'adversarial_examples.pt' is a suitable filename for saving.

```python
n_samples = 1000
x_adv = adversary.run_standard_evaluation(
    x_test[:n_samples],
    y_test[:n_samples],
    bs=250
)

torch.save({
    'x_adv': x_adv,
    'x_clean': x_test[:n_samples],
    'y_true': y_test[:n_samples]
}, 'adversarial_examples.pt')
```

--------------------------------

### Run Individual Attacks (PyTorch)

Source: https://github.com/fra31/auto-attack/blob/master/README.md

Execute each attack individually and collect the adversarial examples found by each. This returns a dictionary mapping attack names to adversarial examples.

```python
dict_adv = adversary.run_standard_evaluation_individual(images, labels, bs=batch_size)
```

--------------------------------

### Initialize Square Attack

Source: https://context7.com/fra31/auto-attack/llms.txt

Configures the Square Attack parameters for adversarial example generation.

```python
square = SquareAttack(
    model,                # Forward pass function (only logits needed)
    norm='Linf',          # 'Linf', 'L2', or 'L1'
    n_queries=5000,       # Maximum number of queries per sample
    eps=8/255,            # Perturbation bound
    p_init=0.8,           # Initial size of perturbation squares
    n_restarts=1,         # Number of random restarts
    seed=0,
    verbose=True,
    targeted=False,       # Set True for targeted attack
    loss='margin',        # 'margin' or 'ce'
    device='cuda'
)

# Generate adversarial examples
x_adv = square.perturb(x_test.cuda(), y_test.cuda())
```

--------------------------------

### Run Standard Evaluation (PyTorch)

Source: https://github.com/fra31/auto-attack/blob/master/README.md

Apply the standard AutoAttack evaluation sequentially on batches of images and labels. This method returns the adversarial examples found.

```python
x_adv = adversary.run_standard_evaluation(images, labels, bs=batch_size)
```

--------------------------------

### run_standard_evaluation - Sequential Attack Pipeline

Source: https://context7.com/fra31/auto-attack/llms.txt

Runs all attacks sequentially, where each subsequent attack only targets samples that remain correctly classified. Returns adversarial examples for the entire dataset.

```APIDOC
## run_standard_evaluation - Sequential Attack Pipeline

### Description
Runs all attacks sequentially, where each subsequent attack only targets samples that remain correctly classified. Returns adversarial examples for the entire dataset.

### Parameters
#### Path Parameters
None

#### Query Parameters
None

#### Request Body
None

### Method
N/A (This is a method of the AutoAttack class)

### Endpoint
N/A (This is a method of the AutoAttack class)

### Request Example
```python
from autoattack import AutoAttack
import torch

model = YourRobustModel()
model.eval()

adversary = AutoAttack(model, norm='Linf', eps=8/255, version='standard')

# Standard evaluation - attacks run sequentially on remaining robust samples
x_adv = adversary.run_standard_evaluation(
    x_test,           # Clean images (NCHW, values in [0, 1])
    y_test,           # True labels
    bs=250,           # Batch size
    return_labels=False  # Set True to also return predicted labels
)

# With state saving for resuming long evaluations
from pathlib import Path
x_adv = adversary.run_standard_evaluation(
    x_test, y_test,
    bs=250,
    state_path=Path('./eval_state.pt')  # Saves progress to disk
)
```

### Response
#### Success Response (200)
- **x_adv** (torch.Tensor) - Adversarial examples for the entire dataset.
- **y_adv** (torch.Tensor, optional) - Predicted labels for the adversarial examples, if `return_labels=True`.

#### Response Example
```
# Output example:
# initial accuracy: 87.14%
# using standard version including apgd-ce, apgd-t, fab-t, square.
# apgd-ce - 1/4 - 38 out of 250 successfully perturbed
# robust accuracy after APGD-CE: 83.50% (total time 45.2 s)
# robust accuracy after APGD-T: 56.20% (total time 312.5 s)
# robust accuracy after FAB-T: 55.80% (total time 425.1 s)
# robust accuracy after SQUARE: 54.12% (total time 520.3 s)
```
```

--------------------------------

### Specify Attacks to Run

Source: https://github.com/fra31/auto-attack/blob/master/README.md

Customize the AutoAttack evaluation by specifying a subset of attacks to run. For example, to only run 'apgd-ce', set the attacks_to_run attribute.

```python
adversary.attacks_to_run = ['apgd-ce']
```

--------------------------------

### Initialize FABAttack_PT

Source: https://context7.com/fra31/auto-attack/llms.txt

Sets up the Fast Adaptive Boundary Attack for PyTorch models to find minimum-norm perturbations.

```python
from autoattack.fab_pt import FABAttack_PT
import torch

model = YourModel()
model.eval()

# Initialize FAB attack
fab = FABAttack_PT(
    model,                # Forward pass function
    norm='Linf',          # 'Linf', 'L2', or 'L1'
    n_restarts=5,         # Number of random restarts
    n_iter=100,           # Iterations per restart
    eps=8/255,            # Maximum perturbation bound
    alpha_max=0.1,        # Maximum step size
    eta=1.05,             # Overshoot factor
    beta=0.9,             # Backward step factor
    verbose=True,
    seed=0,
    targeted=False,       # Set True for targeted version
    device='cuda',
    n_target_classes=9    # For targeted version
)

# Generate adversarial examples
x_adv = fab.perturb(x_test.cuda(), y_test.cuda())
```

--------------------------------

### Utilize AutoAttack Version Presets

Source: https://context7.com/fra31/auto-attack/llms.txt

Select from standard, plus, or rand presets to quickly configure evaluation scenarios.

```python
from autoattack import AutoAttack

model = YourRobustModel()

# STANDARD VERSION (default, recommended for most evaluations)
# Attacks: apgd-ce, apgd-t (targeted), fab-t (targeted), square
adversary_standard = AutoAttack(model, norm='Linf', eps=8/255, version='standard')

# PLUS VERSION (more expensive, thorough evaluation)
# Attacks: apgd-ce (5 restarts), apgd-dlr (5 restarts), fab (5 restarts),
#          square, apgd-t, fab-t
adversary_plus = AutoAttack(model, norm='Linf', eps=8/255, version='plus')

# RAND VERSION (for randomized/stochastic defenses)
# Uses Expectation over Transformation (EoT) with 20 iterations
# Attacks: apgd-ce, apgd-dlr (both with EoT)
adversary_rand = AutoAttack(model, norm='Linf', eps=8/255, version='rand')

# Run evaluations
x_adv_standard = adversary_standard.run_standard_evaluation(x_test, y_test, bs=250)
x_adv_plus = adversary_plus.run_standard_evaluation(x_test, y_test, bs=250)
x_adv_rand = adversary_rand.run_standard_evaluation(x_test, y_test, bs=250)
```

--------------------------------

### Initialize AutoAttack Interface

Source: https://context7.com/fra31/auto-attack/llms.txt

Configure the main AutoAttack class. The model must return logits rather than softmax probabilities.

```python
import torch
from autoattack import AutoAttack

# Load your model (must return logits, not softmax probabilities)
model = YourModel()
model.eval()

# Initialize AutoAttack
adversary = AutoAttack(
    model,                    # Forward pass function returning logits
    norm='Linf',              # Norm: 'Linf', 'L2', or 'L1'
    eps=8/255,                # Perturbation bound
    version='standard',       # 'standard', 'plus', 'rand', or 'custom'
    verbose=True,             # Print progress
    device='cuda',            # Device for computation
    log_path='./log.txt',     # Optional log file path
    seed=None                 # Random seed (None for time-based)
)

# Load test data
x_test = torch.rand(1000, 3, 32, 32)  # Images in [0, 1], NCHW format
y_test = torch.randint(0, 10, (1000,))  # Ground truth labels

# Run standard evaluation
x_adv = adversary.run_standard_evaluation(x_test, y_test, bs=250)

# Check robust accuracy
with torch.no_grad():
    outputs = model(x_adv.cuda())
    robust_acc = (outputs.argmax(1) == y_test.cuda()).float().mean()
    print(f'Robust accuracy: {robust_acc:.2%}')
```

--------------------------------

### Initialize AutoAttack for PyTorch

Source: https://github.com/fra31/auto-attack/blob/master/README.md

Import and initialize AutoAttack for PyTorch models. Ensure your forward_pass function handles inputs in [0, 1] and returns logits. Specify the norm, epsilon, and version.

```python
from autoattack import AutoAttack
adversary = AutoAttack(forward_pass, norm='Linf', eps=epsilon, version='standard')
```

--------------------------------

### AutoAttack Initialization and Configuration

Source: https://context7.com/fra31/auto-attack/llms.txt

Configures the main AutoAttack adversary, allowing for custom attack selection and parameter tuning for APGD, FAB, and Square attacks.

```APIDOC
## AutoAttack Initialization

### Description
Initializes the AutoAttack adversary to evaluate model robustness. Supports custom configurations or preset versions.

### Parameters
- **model** (torch.nn.Module) - Required - The robust model to evaluate.
- **norm** (str) - Required - The norm constraint ('Linf', 'L2', 'L1').
- **eps** (float) - Required - The perturbation bound.
- **version** (str) - Required - The version preset ('standard', 'plus', 'rand', 'custom').

### Request Example
```python
adversary = AutoAttack(model, norm='Linf', eps=8/255, version='custom')
adversary.attacks_to_run = ['apgd-ce', 'apgd-dlr', 'fab', 'square']
```
```

--------------------------------

### Configure Custom AutoAttack Parameters

Source: https://context7.com/fra31/auto-attack/llms.txt

Use version='custom' to manually specify which attacks to run and tune parameters for APGD, FAB, and Square attacks.

```python
from autoattack import AutoAttack
import torch

model = YourRobustModel()
model.eval()

# Initialize with custom version
adversary = AutoAttack(model, norm='Linf', eps=8/255, version='custom')

# Configure specific attacks to run
adversary.attacks_to_run = ['apgd-ce', 'apgd-dlr', 'fab', 'square']

# Customize APGD parameters
adversary.apgd.n_restarts = 5      # Number of random restarts
adversary.apgd.n_iter = 100        # Iterations per restart
adversary.apgd.loss = 'ce'         # Loss function: 'ce' or 'dlr'
adversary.apgd.eot_iter = 1        # EoT iterations (for randomized defenses)

# Customize FAB parameters
adversary.fab.n_restarts = 5
adversary.fab.n_iter = 100
adversary.fab.n_target_classes = 9  # For targeted version

# Customize Square Attack parameters
adversary.square.n_queries = 5000   # Max queries
adversary.square.p_init = 0.8       # Initial p parameter
adversary.square.n_restarts = 1

# Customize targeted APGD
adversary.apgd_targeted.n_restarts = 1
adversary.apgd_targeted.n_target_classes = 9

# Run evaluation
x_adv = adversary.run_standard_evaluation(x_test, y_test, bs=250)
```

--------------------------------

### Run AutoAttack with Custom Version

Source: https://github.com/fra31/auto-attack/blob/master/README.md

Customize the AutoAttack evaluation by specifying a 'custom' version and then defining the attacks to run and their parameters, such as the number of restarts.

```python
if args.version == 'custom':
	adversary.attacks_to_run = ['apgd-ce', 'fab']
	adversary.apgd.n_restarts = 2
	adversary.fab.n_restarts = 2
```

--------------------------------

### Log Intermediate Evaluation Results

Source: https://github.com/fra31/auto-attack/blob/master/README.md

Specify a log path during attack initialization to save intermediate evaluation results to a file.

```python
log_path=/path/to/logfile.txt
```

--------------------------------

### AutoAttack Initialization

Source: https://github.com/fra31/auto-attack/blob/master/README.md

Initializes the AutoAttack adversary object for PyTorch models.

```APIDOC
## AutoAttack Initialization

### Description
Initializes the AutoAttack adversary for evaluating PyTorch models.

### Parameters
- **forward_pass** (callable) - Required - Function returning logits, expects input in [0, 1] (NCHW format).
- **norm** (string) - Required - Threat model norm: 'Linf', 'L2', or 'L1'.
- **eps** (float) - Required - Bound on the norm of adversarial perturbations.
- **version** (string) - Required - Version of AA to use (e.g., 'standard').

### Request Example
from autoattack import AutoAttack
adversary = AutoAttack(forward_pass, norm='Linf', eps=epsilon, version='standard')
```

--------------------------------

### Run Individual Evaluation

Source: https://github.com/fra31/auto-attack/blob/master/README.md

Executes attacks individually and returns the results in a dictionary.

```APIDOC
## run_standard_evaluation_individual

### Description
Runs attacks individually and returns a dictionary containing the adversarial examples found by each attack.

### Parameters
- **images** (tensor) - Required - Input images for evaluation.
- **labels** (tensor) - Required - Correct labels for the input images.
- **bs** (int) - Optional - Batch size for evaluation.

### Response
- **dict_adv** (dict) - Dictionary mapping attack names to their respective adversarial examples.
```

--------------------------------

### Adapt TensorFlow 1.x Models

Source: https://context7.com/fra31/auto-attack/llms.txt

Wraps a TensorFlow 1.x model graph for compatibility with AutoAttack.

```python
import tensorflow as tf
from autoattack import utils_tf
from autoattack import AutoAttack

# Build your TF 1.x model graph
x_input = tf.placeholder(tf.float32, shape=[None, 32, 32, 3])  # NHWC format
y_input = tf.placeholder(tf.int64, shape=[None])
logits = your_tf_model(x_input)  # Must return logits, not probabilities

# Create TF session
sess = tf.Session()
sess.run(tf.global_variables_initializer())

# Wrap model for AutoAttack
model_adapted = utils_tf.ModelAdapter(
    logits,           # Logits tensor
    x_input,          # Input placeholder (NHWC format)
    y_input,          # Labels placeholder
    sess,             # TF session
    num_classes=10    # Number of output classes
)

# Use with AutoAttack
adversary = AutoAttack(
    model_adapted,
    norm='Linf',
    eps=8/255,
    version='standard',
    is_tf_model=True  # Important: set this flag
)

# Run evaluation (input still uses PyTorch tensors in NCHW format)
import torch
x_test_pt = torch.from_numpy(x_test_np.transpose(0, 3, 1, 2)).float()
y_test_pt = torch.from_numpy(y_test_np).long()
x_adv = adversary.run_standard_evaluation(x_test_pt, y_test_pt, bs=250)
```

--------------------------------

### Run Standard Evaluation

Source: https://github.com/fra31/auto-attack/blob/master/README.md

Executes the standard evaluation of the model against adversarial attacks.

```APIDOC
## run_standard_evaluation

### Description
Runs the standard evaluation where attacks are executed sequentially on batches of images.

### Parameters
- **images** (tensor) - Required - Input images for evaluation.
- **labels** (tensor) - Required - Correct labels for the input images.
- **bs** (int) - Optional - Batch size for evaluation.

### Response
- **x_adv** (tensor) - Adversarial examples generated by the evaluation.
```

--------------------------------

### Initialize AutoAttack for TensorFlow 1.X

Source: https://github.com/fra31/auto-attack/blob/master/README.md

Initialize AutoAttack for a TensorFlow 1.X model after adapting it. Set is_tf_model to True.

```python
from autoattack import AutoAttack
adversary = AutoAttack(model_adapted, norm='Linf', eps=epsilon, version='standard', is_tf_model=True)
```

--------------------------------

### Adapt TensorFlow 1.X Model

Source: https://github.com/fra31/auto-attack/blob/master/README.md

Adapt a TensorFlow 1.X model for AutoAttack using ModelAdapter. This requires the model's logits, input placeholder, label placeholder, and a TF session.

```python
from autoattack import utils_tf
model_adapted = utils_tf.ModelAdapter(logits, x_input, y_input, sess)
```

--------------------------------

### Adapt TensorFlow 2.x Models

Source: https://context7.com/fra31/auto-attack/llms.txt

Wraps a TensorFlow 2.x or Keras model for compatibility with AutoAttack.

```python
import tensorflow as tf
from autoattack import utils_tf2
from autoattack import AutoAttack
import torch

# Load your TF 2.x / Keras model (must output logits, NOT softmax)
tf_model = tf.keras.models.load_model('your_model.h5')

# Or build a model without softmax
tf_model = tf.keras.Sequential([
    tf.keras.layers.Conv2D(32, 3, activation='relu', input_shape=(32, 32, 3)),
    tf.keras.layers.Flatten(),
    tf.keras.layers.Dense(10)  # No softmax activation!
])

# Wrap model for AutoAttack
model_adapted = utils_tf2.ModelAdapter(
    tf_model,
    num_classes=10
)

# Use with AutoAttack
adversary = AutoAttack(
    model_adapted,
    norm='Linf',
    eps=8/255,
    version='standard',
    is_tf_model=True
)

# Run evaluation
x_adv = adversary.run_standard_evaluation(x_test, y_test, bs=250)
```

--------------------------------

### Compute Clean Accuracy

Source: https://context7.com/fra31/auto-attack/llms.txt

Calculate the model's accuracy on clean, unperturbed images using the helper method.

```python
from autoattack import AutoAttack
import torch

model = YourRobustModel()
model.eval()

adversary = AutoAttack(model, norm='Linf', eps=8/255)

# Compute clean accuracy
clean_acc = adversary.clean_accuracy(x_test, y_test, bs=250)
print(f'Clean accuracy: {clean_acc:.2%}')
```

--------------------------------

### Citation for Reliable Evaluation Paper

Source: https://github.com/fra31/auto-attack/blob/master/README.md

BibTeX entry for the paper 'Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks'.

```bibtex
@inproceedings{croce2020reliable,
    title = {Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks},
    author = {Francesco Croce and Matthias Hein},
    booktitle = {ICML},
    year = {2020}
}
```

--------------------------------

### Run Sequential Attack Pipeline

Source: https://context7.com/fra31/auto-attack/llms.txt

Execute attacks sequentially where each subsequent attack targets only the samples that remain correctly classified. Supports state saving for resuming long evaluations.

```python
from autoattack import AutoAttack
import torch

model = YourRobustModel()
model.eval()

adversary = AutoAttack(model, norm='Linf', eps=8/255, version='standard')

# Standard evaluation - attacks run sequentially on remaining robust samples
x_adv = adversary.run_standard_evaluation(
    x_test,           # Clean images (NCHW, values in [0, 1])
    y_test,           # True labels
    bs=250,           # Batch size
    return_labels=False  # Set True to also return predicted labels
)

# With state saving for resuming long evaluations
from pathlib import Path
x_adv = adversary.run_standard_evaluation(
    x_test, y_test,
    bs=250,
    state_path=Path('./eval_state.pt')  # Saves progress to disk
)
```

--------------------------------

### Citation for Mind the Box Paper

Source: https://github.com/fra31/auto-attack/blob/master/README.md

BibTeX entry for the paper 'Mind the box: $l_1$-APGD for sparse adversarial attacks on image classifiers'.

```bibtex
@inproceedings{croce2021mind,
    title={Mind the box: $l_1$-APGD for sparse adversarial attacks on image classifiers},
    author={Francesco Croce and Matthias Hein},
    booktitle={ICML},
    year={2021}
}
```

--------------------------------

### Evaluate Robust Models on CIFAR-10

Source: https://context7.com/fra31/auto-attack/llms.txt

Performs a full evaluation of a robust model using the AutoAttack standard version.

```python
import torch
import torchvision.datasets as datasets
import torchvision.transforms as transforms
from autoattack import AutoAttack

# Load model
model = YourRobustModel()
checkpoint = torch.load('model_weights.pt')
model.load_state_dict(checkpoint)
model.cuda()
model.eval()

# Load CIFAR-10 test data
transform = transforms.Compose([transforms.ToTensor()])
testset = datasets.CIFAR10(root='./data', train=False, download=True, transform=transform)
testloader = torch.utils.data.DataLoader(testset, batch_size=10000, shuffle=False)

# Get all test data
x_test, y_test = next(iter(testloader))

# Initialize AutoAttack for Linf threat model
adversary = AutoAttack(
    model,
    norm='Linf',
    eps=8/255,
    version='standard',
    log_path='./autoattack_log.txt'
)
```

--------------------------------

### Implement Standalone APGD Attack

Source: https://context7.com/fra31/auto-attack/llms.txt

Run the Auto-PGD attack independently with automatic step size adaptation.

```python
from autoattack.autopgd_base import APGDAttack
import torch

model = YourModel()
model.eval()

# Initialize APGD attack
apgd = APGDAttack(
    model,                # Forward pass function
    n_iter=100,           # Number of iterations
    norm='Linf',          # 'Linf', 'L2', or 'L1'
    n_restarts=5,         # Number of random restarts
    eps=8/255,            # Perturbation bound
    loss='ce',            # 'ce' (cross-entropy) or 'dlr'
    eot_iter=1,           # EoT iterations for randomized defenses
    rho=0.75,             # Step size reduction threshold
    seed=0,               # Random seed
    verbose=True,
    device='cuda'
)

# Generate adversarial examples
x_adv = apgd.perturb(x_test.cuda(), y_test.cuda())

# Check success rate
with torch.no_grad():
    preds = model(x_adv).argmax(1)
    success_rate = (preds != y_test.cuda()).float().mean()
    print(f'Attack success rate: {success_rate:.2%}')
```

--------------------------------

### APGDAttack - Auto-PGD Attack

Source: https://context7.com/fra31/auto-attack/llms.txt

Standalone implementation of the Auto-PGD attack with automatic step size adaptation.

```APIDOC
## APGDAttack

### Description
Performs an Auto-PGD attack on the provided model using cross-entropy or DLR loss.

### Parameters
- **model** (callable) - Required - Forward pass function.
- **n_iter** (int) - Optional - Number of iterations.
- **norm** (str) - Optional - 'Linf', 'L2', or 'L1'.
- **n_restarts** (int) - Optional - Number of random restarts.
- **eps** (float) - Optional - Perturbation bound.
- **loss** (str) - Optional - 'ce' or 'dlr'.

### Request Example
```python
apgd = APGDAttack(model, n_iter=100, norm='Linf', n_restarts=5, eps=8/255, loss='ce')
x_adv = apgd.perturb(x_test, y_test)
```
```

--------------------------------

### Adapt TensorFlow 2.X Model

Source: https://github.com/fra31/auto-attack/blob/master/README.md

Adapt a TensorFlow 2.X Keras model for AutoAttack using ModelAdapter. The model should not include a softmax activation function.

```python
from autoattack import utils_tf2
model_adapted = utils_tf2.ModelAdapter(tf_model)
```

--------------------------------

### AutoAttack Class - Main Interface

Source: https://context7.com/fra31/auto-attack/llms.txt

The main class for running adversarial robustness evaluation. It orchestrates multiple attacks and provides automatic detection of defense behaviors.

```APIDOC
## AutoAttack Class - Main Interface

### Description
The main class for running adversarial robustness evaluation. It orchestrates multiple attacks and provides automatic detection of defense behaviors.

### Usage Example
```python
import torch
from autoattack import AutoAttack

# Load your model (must return logits, not softmax probabilities)
model = YourModel()
model.eval()

# Initialize AutoAttack
adversary = AutoAttack(
    model,                    # Forward pass function returning logits
    norm='Linf',              # Norm: 'Linf', 'L2', or 'L1'
    eps=8/255,                # Perturbation bound
    version='standard',       # 'standard', 'plus', 'rand', or 'custom'
    verbose=True,             # Print progress
    device='cuda',            # Device for computation
    log_path='./log.txt',     # Optional log file path
    seed=None                 # Random seed (None for time-based)
)

# Load test data
x_test = torch.rand(1000, 3, 32, 32)  # Images in [0, 1], NCHW format
y_test = torch.randint(0, 10, (1000,))  # Ground truth labels

# Run standard evaluation
x_adv = adversary.run_standard_evaluation(x_test, y_test, bs=250)

# Check robust accuracy
with torch.no_grad():
    outputs = model(x_adv.cuda())
    robust_acc = (outputs.argmax(1) == y_test.cuda()).float().mean()
    print(f'Robust accuracy: {robust_acc:.2%}')
```
```

--------------------------------

### Implement Square Attack

Source: https://context7.com/fra31/auto-attack/llms.txt

Execute a score-based black-box attack that does not require model gradients.

```python
from autoattack.square import SquareAttack
import torch

model = YourModel()
model.eval()
```

--------------------------------

### run_standard_evaluation_individual - Independent Attack Evaluation

Source: https://context7.com/fra31/auto-attack/llms.txt

Runs each attack independently on the full test set, useful for comparing attack effectiveness.

```APIDOC
## run_standard_evaluation_individual - Independent Attack Evaluation

### Description
Runs each attack independently on the full test set, useful for comparing attack effectiveness.

### Parameters
#### Path Parameters
None

#### Query Parameters
None

#### Request Body
None

### Method
N/A (This is a method of the AutoAttack class)

### Endpoint
N/A (This is a method of the AutoAttack class)

### Request Example
```python
from autoattack import AutoAttack
import torch

model = YourRobustModel()
model.eval()

adversary = AutoAttack(model, norm='Linf', eps=8/255, version='standard')

# Individual evaluation - each attack runs on all samples independently
adv_dict = adversary.run_standard_evaluation_individual(
    x_test, y_test,
    bs=250,
    return_labels=True  # Returns (x_adv, y_adv) tuples
)

# Access adversarial examples from each attack
x_adv_apgd_ce, y_adv_apgd_ce = adv_dict['apgd-ce']
x_adv_apgd_t, y_adv_apgd_t = adv_dict['apgd-t']
x_adv_fab_t, y_adv_fab_t = adv_dict['fab-t']
x_adv_square, y_adv_square = adv_dict['square']

# Compare attack success rates
for attack_name, (x_adv, _) in adv_dict.items():
    with torch.no_grad():
        preds = model(x_adv.cuda()).argmax(1)
        acc = (preds == y_test.cuda()).float().mean()
        print(f'{attack_name}: {acc:.2%} robust accuracy')
```

### Response
#### Success Response (200)
- **adv_dict** (dict) - A dictionary where keys are attack names and values are tuples of (adversarial_examples, predicted_labels).

#### Response Example
```
# Example access:
x_adv_apgd_ce, y_adv_apgd_ce = adv_dict['apgd-ce']

# Example comparison:
# apgd-ce: 54.12% robust accuracy
# apgd-t: 53.90% robust accuracy
# fab-t: 53.80% robust accuracy
# square: 53.50% robust accuracy
```
```

--------------------------------

### clean_accuracy - Compute Clean Accuracy

Source: https://context7.com/fra31/auto-attack/llms.txt

Helper method to compute the model's accuracy on clean (unperturbed) images.

```APIDOC
## clean_accuracy - Compute Clean Accuracy

### Description
Helper method to compute the model's accuracy on clean (unperturbed) images.

### Parameters
#### Path Parameters
None

#### Query Parameters
None

#### Request Body
None

### Method
N/A (This is a method of the AutoAttack class)

### Endpoint
N/A (This is a method of the AutoAttack class)

### Request Example
```python
from autoattack import AutoAttack
import torch

model = YourRobustModel()
model.eval()

adversary = AutoAttack(model, norm='Linf', eps=8/255)

# Compute clean accuracy
clean_acc = adversary.clean_accuracy(x_test, y_test, bs=250)
print(f'Clean accuracy: {clean_acc:.2%}')
```

### Response
#### Success Response (200)
- **clean_acc** (float) - The clean accuracy of the model.

#### Response Example
```
Clean accuracy: 87.14%
```
```

--------------------------------

### Fix Random Seed for Attacks

Source: https://github.com/fra31/auto-attack/blob/master/README.md

Set the random seed for reproducible attacks. If not set, a different seed is chosen for each attack.

```python
adversary.seed = 0
```

--------------------------------

### Run Independent Attack Evaluation

Source: https://context7.com/fra31/auto-attack/llms.txt

Evaluate each attack independently on the full test set to compare individual attack effectiveness.

```python
from autoattack import AutoAttack
import torch

model = YourRobustModel()
model.eval()

adversary = AutoAttack(model, norm='Linf', eps=8/255, version='standard')

# Individual evaluation - each attack runs on all samples independently
adv_dict = adversary.run_standard_evaluation_individual(
    x_test, y_test,
    bs=250,
    return_labels=True  # Returns (x_adv, y_adv) tuples
)

# Access adversarial examples from each attack
x_adv_apgd_ce, y_adv_apgd_ce = adv_dict['apgd-ce']
x_adv_apgd_t, y_adv_apgd_t = adv_dict['apgd-t']
x_adv_fab_t, y_adv_fab_t = adv_dict['fab-t']
x_adv_square, y_adv_square = adv_dict['square']

# Compare attack success rates
for attack_name, (x_adv, _) in adv_dict.items():
    with torch.no_grad():
        preds = model(x_adv.cuda()).argmax(1)
        acc = (preds == y_test.cuda()).float().mean()
        print(f'{attack_name}: {acc:.2%} robust accuracy')
```

--------------------------------

### Implement Targeted APGD Attack

Source: https://context7.com/fra31/auto-attack/llms.txt

Use the targeted APGD variant to force misclassification into specific target classes.

```python
from autoattack.autopgd_base import APGDAttack_targeted
import torch

model = YourModel()
model.eval()

# Initialize targeted APGD
apgd_targeted = APGDAttack_targeted(
    model,
    n_iter=100,
    norm='Linf',
    n_restarts=1,
    eps=8/255,
    n_target_classes=9,   # Number of target classes to try
    eot_iter=1,
    rho=0.75,
    verbose=True,
    device='cuda'
)

# Generate adversarial examples (automatically selects target classes)
x_adv = apgd_targeted.perturb(x_test.cuda(), y_test.cuda())
```

--------------------------------

### APGDAttack_targeted - Targeted Auto-PGD

Source: https://context7.com/fra31/auto-attack/llms.txt

Targeted version of the APGD attack designed to force misclassification into specific target classes.

```APIDOC
## APGDAttack_targeted

### Description
Executes a targeted APGD attack to misclassify inputs into specific target classes.

### Parameters
- **n_target_classes** (int) - Required - Number of target classes to attempt.
- **n_iter** (int) - Optional - Number of iterations.

### Request Example
```python
apgd_targeted = APGDAttack_targeted(model, n_iter=100, n_target_classes=9)
x_adv = apgd_targeted.perturb(x_test, y_test)
```
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.