---

name: attacks description: "Foolbox adversarial-attack guidance for selecting fixed-epsilon, minimization, gradient, decision-based, score-based, stochastic, spatial, dataset, EOT, and custom attack workflows." disable-model-invocation: true metadata: disco-role: operating license: MIT

Foolbox attacks

Use this route when the task is to generate adversarial examples, compare robust accuracy, choose an attack by threat model, configure criteria or distances, or implement a new attack. Read references/attack-overview.md to choose a family, references/api-reference.md for call semantics, and references/workflows.md for recipes.

Command path

The scripts/ path below is relative to the generated Foolbox skill root, not to a native Foolbox checkout and not to the caller's current directory. From any cwd, use the directory containing the root SKILL.md:

# Replace this non-executable placeholder with the absolute directory containing the root SKILL.md.
export SKILL_ROOT=/path/to/installed/skills/disco/foolbox
cd "$SKILL_ROOT"

Use the actual skill-root path when it differs from this installation. Keep plots and other generated artifacts in an explicit absolute output directory or "$SKILL_ROOT/outputs/"; never rely on a plot filename resolving to the native checkout or overwrite files under references/ or scripts/.

Run an attack safely

1. Wrap the model through the models route, check clean accuracy, and ensure inputs lie inside the declared bounds.
2. Choose untargeted labels or a TargetedMisclassification criterion. Confirm the concrete attack supports that criterion.
3. Instantiate the attack with explicit steps for expensive or stochastic methods. Use epsilons as a scalar for one budget or a sequence to compare budgets in one call.
4. Use clipped outputs for visualizing or measuring budgeted adversarials; use success to calculate attack success and robust accuracy.
5. Report backend, attack class, distance, epsilon(s), steps, clean accuracy, and stochastic/repeat policy. Never compare attack results without stating whether the model and data preprocessing are identical.

Run the helper below for a safe NumPy noise plus DatasetAttack check. Framework gradient attacks require an installed framework and are not proved by the CPU smoke.

cd "$SKILL_ROOT"
python sub-skills/attacks/scripts/smoke_attacks.py --help
python sub-skills/attacks/scripts/smoke_attacks.py

The helper is also linked at scripts/smoke_attacks.py.

Select by threat model

• Fast white-box: FGSM/FGM, LinfPGD, L2PGD, basic iterative, momentum, Adam-PGD; requires differentiable framework tensors.
• Minimization: Carlini-Wagner, EAD, DeepFool, NewtonFool, contrast, blur, BoundaryAttack; choose when the perturbation should be minimized or when the attack owns an early-stop distance.
• Decision/score/black-box: additive/repeated noise, HopSkipJump, BoundaryAttack, Brendel-Bethge, Pointwise, DatasetAttack; use when gradients or probabilities are unavailable.
• Special geometry: SpatialAttack searches rotations/translations and has no normal epsilon argument; it expects 4-D image batches.
• Randomized models: wrap the model with EOT before a compatible gradient attack; EOT averages repeated model outputs and may be expensive.

Use references/troubleshooting.md for unsupported criteria, missing distances, invalid epsilons, bounds, channel axes, and optional-backend failures. For authoring, read references/attack-authoring.md.