6.1.1. Installation and configuration

Prerequisites: The Machine Learning Environment

ART is a powerful abstraction layer, but it doesn’t exist in a vacuum. It operates on top of established machine learning frameworks. Before you even think about installing ART, you must have a working Python environment with one of its supported frameworks already installed and configured.

• Python Version: ART requires Python 3.8 or newer. Ensure your environment manager (like Conda or venv) is configured accordingly.
• Core ML Framework: You need a primary ML framework installed, such as TensorFlow, PyTorch, Keras, or Scikit-learn. ART’s functionality directly depends on the backend you choose, as it uses the framework’s native operations to compute gradients and modify inputs.

Treat the ML framework as the engine and ART as the sophisticated diagnostic and testing equipment you plug into it. If the engine isn’t running, the equipment is useless.

Core Installation

Installation is managed through `pip`, Python’s package installer. However, a generic installation is often insufficient. To unlock ART’s full potential for your specific target system, you must install it with the correct “extras” that match your ML framework.

Standard Installation

The most basic installation provides ART’s core logic but without the deep integration hooks for any specific framework. This is rarely what you want for practical red teaming but is useful for exploring the library’s structure.

pip install adversarial-robustness-toolbox

Framework-Specific Installation

This is the correct approach for any practical engagement. By specifying an extra during installation, you instruct `pip` to pull in the necessary dependencies that allow ART to seamlessly interface with your chosen framework’s models and data structures. This is critical for gradient-based attacks, which form the backbone of most adversarial testing.

The following table outlines the installation commands for the most common frameworks. You should only install the one relevant to your target model’s environment to avoid dependency conflicts.

Verifying Your Setup

Once the installation completes, a quick verification script is essential. This simple check confirms that the library is accessible in your Python environment and reports the installed version, which is crucial for reproducibility and debugging.

# verification_script.py
import art

try:
    print(f"ART version: {art.__version__}")
    print("ART installation successful.")
except ImportError:
    print("Error: ART is not installed or not found in the Python path.")
except Exception as e:
    print(f"An unexpected error occurred: {e}")

Running this script should produce a clean output with the version number. Any errors point to a problem with your Python environment or the installation process itself.

The Bridge to Your Model: The ART Estimator

Installation is just the first step. The most critical configuration task is making your target model compatible with ART’s tools. You cannot directly pass a standard PyTorch `nn.Module` or TensorFlow `tf.keras.Model` to an ART attack function. Instead, you must wrap it in an ART Estimator.

Estimators, like ARTClassifier or ARTRegressor, are wrapper classes that provide a standardized interface for ART’s components. They expose methods for prediction, loss gradient calculation, and other functionalities that attacks and defenses rely on. This abstraction is what allows ART to be framework-agnostic.

The following example demonstrates how to wrap a pre-trained PyTorch model. The key is providing the necessary metadata to the PyTorchClassifier, such as the model object itself, the loss function, input shape, and number of classes. This information allows ART to correctly compute gradients and craft adversarial examples.

# Assume 'model' is a pre-trained PyTorch nn.Module and is in eval mode
# Assume 'criterion' is a PyTorch loss function, e.g., nn.CrossEntropyLoss()
# Assume 'optimizer' is a PyTorch optimizer, e.g., optim.Adam(...)

import torch
import torch.nn as nn
from art.estimators.classification import PyTorchClassifier

# 1. Your existing, trained PyTorch model (example)
#    In a real scenario, you would load your actual model here.
model = nn.Sequential(nn.Linear(784, 128), nn.ReLU(), nn.Linear(128, 10))
model.eval() # Set model to evaluation mode

# 2. Define model characteristics required by ART
criterion = nn.CrossEntropyLoss()
input_shape = (1, 28, 28) # Example for MNIST (channels, height, width)
nb_classes = 10

# 3. Create the ART Estimator wrapper
#    This is the crucial configuration step.
classifier = PyTorchClassifier(
    model=model,
    loss=criterion,
    input_shape=input_shape,
    nb_classes=nb_classes,
    clip_values=(0, 1) # Min and max values of the input data (e.g., normalized images)
)

# 4. The 'classifier' object is now ready to be used with ART attacks
print("ART classifier created successfully.")
print(f"Input shape: {classifier.input_shape}")
print(f"Number of classes: {classifier.nb_classes}")

This wrapped classifier object, not the original model, is what you will use in subsequent attack and defense implementations. Mastering this wrapping process is the single most important configuration skill for using ART effectively.