Interactive tool
Attack Selector
Describe the model access, modality, adversary goal, and defenses in place. Get a ranked, filtered shortlist of the adversarial-ML attacks that are actually feasible against that setup — each with its access requirement, compute/query budget, transferability, the canonical paper, and a reference implementation.
Constraint-driven: an attack is shown only when its access requirement is satisfiable and it is applicable to your modality and goal. Defenses you mark present push the attacks they actually counter down the ranking (and flag the adaptive attack that beats them). 39 attacks catalogued · reviewed 2026-08.
Full attack catalogue
| Attack | Family | Access | Goal | Refs |
|---|---|---|---|---|
| FGSM (Fast Gradient Sign Method) | Evasion · gradient | white-box | evasion | paper · repo |
| PGD (Projected Gradient Descent) | Evasion · gradient | white-box | evasion | paper · repo |
| C&W (Carlini & Wagner L2) | Evasion · optimization | white-box | evasion | paper · repo |
| AutoAttack | Evasion · ensemble | white-box | evasion | paper · repo |
| DeepFool | Evasion · optimization | white-box | evasion | paper · repo |
| JSMA (Jacobian Saliency Map Attack) | Evasion · gradient (L0) | white-box | evasion | paper · repo |
| BIM / I-FGSM (Basic Iterative Method) | Evasion · gradient | white-box | evasion | paper · repo |
| MI-FGSM (Momentum Iterative) | Evasion · transfer | white-box | evasion | paper · repo |
| HopSkipJump | Evasion · decision-based | black-box-labels | evasion | paper · repo |
| Boundary Attack | Evasion · decision-based | black-box-labels | evasion | paper · repo |
| Square Attack | Evasion · score-based | black-box-logits | evasion | paper · repo |
| ZOO (Zeroth-Order Optimization) | Evasion · score-based | black-box-logits | evasion | paper · repo |
| NES / Bandits (query-limited black-box) | Evasion · score-based | query-limited | evasion | paper · repo |
| Sign-OPT / OPT-attack | Evasion · decision-based | black-box-labels | evasion | paper · repo |
| SPSA | Evasion · score-based | black-box-logits | evasion | paper · repo |
| EOT (Expectation over Transformation) | Evasion · robust perturbation | white-box | evasion | paper · repo |
| BPDA (Backward Pass Differentiable Approx.) | Evasion · adaptive | white-box | evasion | paper · repo |
| Universal Adversarial Perturbation (UAP) | Evasion · universal | white-box | evasion | paper · repo |
| X-Transfer (super-transferable CLIP UAP) | Evasion · universal (multimodal) | query-limited | evasion | paper · repo |
| Adversarial Patch | Evasion · physical | white-box | evasion | paper · repo |
| DPatch / object-detector patch | Evasion · physical (detection) | white-box | evasion | paper · repo |
| TextFooler | Evasion · NLP (word-level) | black-box-logits | evasion | paper · repo |
| BERT-Attack | Evasion · NLP (MLM-guided) | black-box-logits | evasion | paper · repo |
| GCG (Greedy Coordinate Gradient suffix) | Evasion · LLM jailbreak | white-box | evasion | paper · repo |
| AutoDAN | Evasion · LLM jailbreak | white-box | evasion | paper · repo |
| PAIR (Prompt Automatic Iterative Refinement) | Evasion · LLM jailbreak (black-box) | query-limited | evasion | paper · repo |
| Training-data poisoning (label flipping / clean-label) | Poisoning · availability/integrity | black-box-labels | poisoning | paper · repo |
| BadNets (backdoor / trojan trigger) | Poisoning · backdoor | black-box-labels | poisoning | paper · repo |
| Model extraction (functionality stealing) | Extraction | black-box-logits | extraction | paper · repo |
| Knockoff Nets | Extraction | black-box-logits | extraction | paper · repo |
| Model Inversion | Inversion · privacy | black-box-logits | inversion | paper · repo |
| GAN-guided / GMI Model Inversion | Inversion · privacy | white-box | inversion | paper · repo |
| Membership Inference (shadow-model) | Membership inference · privacy | black-box-logits | membership-inference | paper · repo |
| LiRA (Likelihood Ratio MIA) | Membership inference · privacy | black-box-logits | membership-inference | paper · repo |
| Training-data extraction (LLM memorization) | Inversion · LLM privacy | black-box-labels | inversion, membership-inference | paper · repo |
| Bullseye Polytope (transfer-learning poisoning) | Poisoning · clean-label | white-box | poisoning | paper · repo |
| Witches' Brew (gradient-matching poisoning) | Poisoning · clean-label (from-scratch) | white-box | poisoning | paper · repo |
| Audio adversarial examples (targeted ASR) | Evasion · audio | white-box | evasion | paper · repo |
| Visual prompt injection (VLM image jailbreak) | Evasion · multimodal jailbreak | white-box | evasion | paper · repo |
Where each attack class is covered in depth
The shortlist above names the canonical paper and a reference implementation for each attack. These are this site's write-ups of how the families work, what they cost, and which defenses survive them.
- Evasion attacks: FGSM, PGD, C&W
- Universal adversarial perturbations
- Adversarial patches and physical attacks
- Transferability and black-box attacks
- Adversarial robustness for text and NLP
- GCG-class adversarial suffix attacks
- CLIP adversarial attacks and super transfer
- Vision-language model attacks
- Data poisoning and backdoor attacks
- Model extraction attacks
- Model inversion attacks
- Membership inference attacks
- Training-data extraction from LLMs
- Certified robustness and randomized smoothing
- Evaluating adversarial robustness correctly
- Adversarial attack libraries compared