---

name: evasion-and-preprocessing description: "Use ART evasion attacks, preprocessing defences, and adversarial training recipes for image/tabular robustness workflows." disable-model-invocation: true metadata: disco-role: operating license: MIT

Evasion and preprocessing

Use this sub-skill when the task is to generate evasion adversarial examples, select a white-box/black-box/physical image attack, add preprocessing defences, or plan adversarial training with ART estimators.

Route here

• Craft FGSM/FGM, PGD/BIM/MIM/AutoPGD/AutoAttack, Carlini, DeepFool, ElasticNet, JSMA, universal perturbation, virtual adversarial, HopSkipJump, Boundary, ZOO, SimBA, Square, Pixel/Threshold, SignOPT, DecisionTree, spatial, feature-adversary, or image-patch attacks.
• Add image/tabular preprocessing defences such as standardisation, spatial smoothing, feature squeezing, JPEG compression, Gaussian augmentation, label smoothing, Mixup, CutMix, Cutout, thermometer encoding, total variation minimization, or PixelDefend.
• Plan adversarial training with AdversarialTrainer, AdversarialTrainerMadryPGD, or TRADES-style trainers.

Route away

• Model wrapping, clip_values, input_shape, backend device setup, and estimator construction details belong to ../estimators-and-models/ or ../setup-and-backends/.
• Poisoning, backdoors, membership/attribute inference, model inversion, or model extraction belong to ../poisoning-inference-extraction/.
• Robustness metrics, certification, tree verification, security curves, and gradient checks after attack generation belong to ../evaluation-and-certification/.
• Speech, object-detection-heavy, malware, and audio-heavy evasion workflows are outside this selected runtime scope unless a future refresh adds their required backends. Recognize their ART class names, but do not promise runnable coverage here.

Operating sequence

1. Confirm the estimator capability: loss gradients for PGD/FGM/BIM/MIM/AutoPGD, class gradients for Carlini/DeepFool/JSMA-style attacks, prediction-only classifiers for hard-label black-box attacks, or neural-network/image-specific support for patch/spatial attacks.
2. Match all perturbation budgets to the estimator input scale and clip_values; for normalized [0, 1] images use budgets such as 8/255, not 8.
3. Check shape conventions before running an attack: PyTorch image estimators usually use channels_first=True and NCHW; many NumPy image preprocessors default to channels_first=False and NHWC.
4. For targeted attacks, pass target labels as y to generate; use one-hot labels unless the wrapped estimator workflow explicitly uses class-index labels.
5. Add preprocessing defences either directly as callable preprocessors or through estimator preprocessing_defences; do not treat preprocessing alone as proof of robustness.
6. For adversarial training, start from a bounded PGD/FGM attack, verify labels and clipping, then choose generic, Madry PGD, or TRADES training according to the estimator backend.

References

• Attack family/API chooser: references/attack-api-reference.md
• Preprocessing and adversarial training recipes: references/preprocessing-and-training.md
• Evasion/preprocessing troubleshooting: references/troubleshooting.md

Bundled checks

• Tiny CPU PyTorch PGD/FGM smoke: scripts/smoke_evasion_pytorch.py
• Tiny NumPy standardisation/spatial smoothing smoke: scripts/smoke_preprocessor_numpy.py

Run bundled scripts with --help first; they use synthetic data and do not download datasets.