Adversarial Robustness Lab
Local · No API CostFool an image classifier with an adversarial perturbation, then see how well a defense actually recovers it
Upload a photo, then craft an adversarial attack against a pretrained ImageNet classifier — a tiny, mostly-invisible pixel change (FGSM/PGD), a visible "sticker" patch, or a black-box attack that never sees the model's gradients, only its predictions. Leave the target label blank for an untargeted attack (any wrong label counts), or type a specific ImageNet class to try to force that exact misprediction — a strictly harder attack. Then try a JPEG-recompression defense and randomized smoothing, and see whether either actually recovers the correct label (often neither does fully — that's a real, honest finding about these defenses' limits, not a broken demo).
Defense #3: Adversarial training (a digit-classifier demo)
Unlike the two defenses above, this one changes HOW a model is trained, not what happens to an image at inference time. Two small digit classifiers were trained once, offline, on the same data — one normally, one adversarially (Madry-style: trained directly on PGD-attacked examples). Pick a digit (or upload your own), attack BOTH models with the same white-box PGD attack, and see the real difference.