Version 2.0.0 with batch support, model and defense zoo, threshold support and more

• batch support: check out the new example in the README
• model and defense zoo: https://foolbox.readthedocs.io/en/latest/user/zoo.html
• attacks take an optional threshold argument to stop attacks once that threshold is reached

foolbox.attacks now refers to the attacks with batch support. The old attacks can still be accessed under foolbox.v1.attacks. Batch support has been added to almost all attacks and new attacks will only be implemented with batch support. If you need batch support for an old attack that has not yet been adapted, please open an issue.

Version 2.0.0rc0

Merge pull request #378 from jonasrauber/rc

2.0.0rc0

Version 2.0.0b0

Batch-support is finally here!

See #316 for details until we have updated the documentation. Right now it's still limited to a few attacks, but feel free to open an issue for any attack that you need. It's easy to extend to new attacks, we just haven't done it yet and will prioritize based on requests.

Version 1.8.0

Foolbox Model Zoo

Foolbox now has an easy way to load models or defenses from Git repos: https://foolbox.readthedocs.io/en/latest/user/zoo.html

Version 1.7.0

New Features

• Foolbox now has support for the Spatial Attack (https://arxiv.org/abs/1712.02779)

Bug Fixes

• Foolbox now uses its own random number generators to be independent of seeds set inside models.

Version 1.6.2

added missing backward() support to the CompositeModel model wrapper

Version 1.6.1

The foolbox.models.TensorFlowModel.from_keras constructor now automatically uses the session used by tf.keras instead of TensorFlow's default session.

Version 1.6.0

New features

• support for TensorFlow Eager: TensorFlowEagerModel
• improved support for tensorflow.keras models: TensorFlowModel.from_keras(...)
• Foolbox-native implementation of the Carlini Wagner L2 attack: CarliniWagnerL2Attack

Version 1.5.0

New features

• all Foolbox attacks now support early stopping when reaching a certain perturbation size
  • just pass a threshold to the attack or Adversarial instance during initialization
• the distance metric can now be passed to the attack during initialization (no need to manually create a Adversarial instance anymore)

Version 1.4.0

• The Adversarial class now remembers the model output for the best adversarial so far. For deterministic models this is the same as fmodel.predictions(adversarial.image), but it can be useful for non-deterministic models. Note that very close to the decision boundary even otherwise deterministic models can become stochastic because of non-deterministic floating point operations such as reduce_sum. In addtion to the new output attribute, there is also a new adversarial_class attribute for convience; it just takes the argmax of the output.
• new ADefAttack thanks to @EvgeniaAR
• new NewtonFoolAttack thanks to @bveliqi
• new FAQ section in the docs: https://foolbox.readthedocs.io/en/latest/user/faq.html