class torchattacks.attack.Attack(name, model)[source]

Base class for all attacks.


It automatically set device to the device where given model is. It basically changes training mode to eval during attack process. To change this, please see set_training_mode.


It defines the computation performed at every call. Should be overridden by all subclasses.


Get attack mode.

save(data_loader, save_path=None, verbose=True, return_verbose=False, save_pred=False)[source]

Save adversarial images as torch.tensor from given

  • save_path (str) – save_path.
  • data_loader ( – data loader.
  • verbose (bool) – True for displaying detailed information. (Default: True)
  • return_verbose (bool) – True for returning detailed information. (Default: False)
  • save_pred (bool) – True for saving predicted labels (Default: False)

Set attack mode as default mode.


Set attack mode as targeted.

Parameters:target_map_function (function) – Label mapping function. e.g. lambda images, labels:(labels+1)%10. None for using input labels as targeted labels. (Default)

Set attack mode as targeted with least likely labels. :param kth_min: label with the k-th smallest probability used as target labels. (Default: 1) :type kth_min: str


Set attack mode as targeted with random labels. :param num_classses: number of classes. :type num_classses: str


Set the return type of adversarial images: int or float.

Parameters:type (str) – ‘float’ or ‘int’. (Default: ‘float’)


If ‘int’ is used for the return type, the file size of adversarial images can be reduced (about 1/4 for CIFAR10). However, if the attack originally outputs float adversarial images (e.g. using small step-size than 1/255), it might reduce the attack success rate of the attack.

set_training_mode(model_training=False, batchnorm_training=False, dropout_training=False)[source]

Set training mode during attack process.

  • model_training (bool) – True for using training mode for the entire model during attack process.
  • batchnorm_training (bool) – True for using training mode for batchnorms during attack process.
  • dropout_training (bool) – True for using training mode for dropouts during attack process.


For RNN-based models, we cannot calculate gradients with eval mode. Thus, it should be changed to the training mode during the attack.