Package: aijack
AIJack: Security and Privacy Risk Simulator for Machine Learning❤️If you like AIJack, please considerbecoming a GitHub Sponsor❤️What is AIJack?AIJack is an easy-to-use open-source simulation tool for testing the security of your AI system against hijackers. It provides advanced security techniques likeDifferential Privacy,Homomorphic Encryption,K-anonymityandFederated Learningto guarantee protection for your AI. With AIJack, you can test and simulate defenses against various attacks such asPoisoning,Model Inversion,Backdoor, andFree-Rider. We support more than 30 state-of-the-art methods. For more information, check ourdocumentationand start securing your AI today with AIJack.InstallationYou can install AIJack withpip. AIJack requires Boost and pybind11.apt install -y libboost-all-dev
pip install -U pip
pip install "pybind11[global]"

pip install aijackIf you want to use the latest-version, you can directly install from GitHub.pip install git+https://github.com/Koukyosyumei/AIJackWe also provideDockerfile.Quick StartWe briefly introduce the overview of AIJack.FeaturesAll-around abilities for both attack & defensePyTorch-friendly designCompatible with scikit-learnFast Implementation with C++ backendMPI-Backend for Federated LearningExtensible modular APIsBasic InterfacePython APIFor standard machine learning algorithms, AIJack allows you to simulate attacks against machine learning models withAttackerAPIs. AIJack mainly supports PyTorch or sklearn models.# abstract codeattacker=Attacker(target_model)result=attacker.attack()For instance, we can implement Poisoning Attack against SVM implemented with sklearn as follows.fromaijack.attackimportPoison_attack_sklearnattacker=Poison_attack_sklearn(clf,X_train,y_train)malicious_data,log=attacker.attack(initial_data,1,X_valid,y_valid)For distributed learning such as Federated Learning and Split Learning, AIJack offers four basic APIs:Client,Server,API, andManager.ClientandServerrepresent each client and server within each distributed learning scheme. You can execute training by registering the clients and servers toAPIand running it.Managergives additional abilities such as attack, defense, or parallel computing toClient,ServerorAPIviaattachmethod.# abstract codeclient=[Client(),Client()]server=Server()api=API(client,server)api.run()# execute trainingc_manager=ClientManagerForAdditionalAbility(...)s_manager=ServerManagerForAdditionalAbility(...)ExtendedClient=c_manager.attach(Client)ExtendedServer=c_manager.attach(Server)extended_client=[ExtendedClient(...),ExtendedClient(...)]extended_server=ExtendedServer(...)api=API(extended_client,extended_server)api.run()# execute trainingFor example, the bellow code implements the scenario where the server in Federated Learning tries to steal the training data with gradient-based model inversion attack.fromaijack.collaborative.fedavgimportFedAVGAPI,FedAVGClient,FedAVGServerfromaijack.attack.inversionimportGradientInversionAttackServerManagermanager=GradientInversionAttackServerManager(input_shape)FedAVGServerAttacker=manager.attach(FedAVGServer)clients=[FedAVGClient(model_1),FedAVGClient(model_2)]server=FedAVGServerAttacker(clients,model_3)api=FedAVGAPI(server,clients,criterion,optimizers,dataloaders)api.run()AIValut: A simple DBMS for debugging ML ModelsWe also provide a simple DBMS namedAIValutdesigned specifically for SQL-based algorithms. AIValut currently supports Rain, a SQL-based debugging system for ML models. In the future, we have plans to integrate additional advanced features from AIJack, including K-Anonymity, Homomorphic Encryption, and Differential Privacy.AIValut has its own storage engine and query parser, and you can train and debug ML models with SQL-like queries. For example, theComplaintquery automatically removes problematic records given the specified constraint.#WetrainanMLmodeltoclassifywhethereachcustomerwillgobankruptornotbasedontheirageanddebt.#Wewantthetrainedmodeltoclassifythecustomeraspositivewhenhe/shehasmoredebtthanorequalto100.#The10threcordseemsproblematicfortheaboveconstraint.>>Select*Frombankruptidagedebty140002211003221004323005445016301001763310185342019395301104910000#TrainLogisticRegressionwiththenumberofiterationsof100andthelearningrateof1.#Thenameofthetargetfeatureis`y`,andweuseallotherfeaturesastrainingdata.>>Logreglrmodelidy1001FromSelect*FrombankruptTrainedParameters:(0):2.771564(1):-0.236504(2):0.967139AUC:0.520000Predictiononthetrainingdataisstoredat`prediction_on_training_data_lrmodel`#Removeonerecordsothatthemodelwillpredict`positive(class1)`forthesampleswith`debt`greaterorequalto100.>>ComplaintcompShouldbe1Remove1AgainstLogreglrmodelidy1001FromSelect*FrombankruptWheredebtGeq100FixedParameters:(0):-4.765492(1):8.747224(2):0.744146AUC:1.000000Predictiononthefixedtrainingdataisstoredat`prediction_on_training_data_comp_lrmodel`For more detailed information and usage instructions, please refer toaivalut/README.md.Please use AIValut only for research purpose.ResourcesYou can also find more examples in our tutorials and documentation.ExamplesDocumentationAPI ReferenceSupported AlgorithmsCollaborativeHorizontal FLFedAVG,FedProx,FedKD,FedGEMS,FedMD,DSFL,MOON,FedExPCollaborativeVertical FLSplitNN,SecureBoostAttackModel InversionMI-FACE,DLG,iDLG,GS,CPL,GradInversion,GAN AttackAttackLabel LeakageNorm AttackAttackPoisoningHistory Attack,Label Flip,MAPF,SVM PoisoningAttackBackdoorDBA,Model ReplacementAttackFree-RiderDelta-WeightAttackEvasionGradient-Descent Attack,FGSM,DIVAAttackMembership InferenceShadow AttackDefenseHomomorphic EncryptionPaillierDefenseDifferential PrivacyDPSGD,AdaDPS,DPlisDefenseAnonymizationMondrianDefenseRobust TrainingPixelDP,Cost-Aware Robust Tree EnsembleDefenseDebuggingModel Assertions,Rain,Neuron CoverageDefenseOthersSoteria,FoolsGold,MID,Sparse GradientCitationIf you use AIJack for your research, please cite the repo and our arXiv paper.@misc{repotakahashi2023aijack,
      author = {Hideaki, Takahashi},
      title = {AIJack},
      year = {2023},
      publisher = {GitHub},
      journal = {GitHub Repository},
      howpublished = {\url{https://github.com/Koukyosyumei/AIJack}},
}

@misc{takahashi2023aijack,
      title={AIJack: Security and Privacy Risk Simulator for Machine Learning}, 
      author={Hideaki Takahashi},
      year={2023},
      eprint={2312.17667},
      archivePrefix={arXiv},
      primaryClass={cs.LG}
}Related PublicationsBelow you can find a list of papers and books that either use or extend AIJack.Huang, Shiyuan, et al. "Video in 10 Bits: Few-Bit VideoQA for Efficiency and Privacy." European Conference on Computer Vision. Cham: Springer Nature Switzerland, 2022.Song, Junzhe, and Dmitry Namiot. "A Survey of the Implementations of Model Inversion Attacks." International Conference on Distributed Computer and Communication Networks. Cham: Springer Nature Switzerland, 2022.Kapoor, Amita, and Sharmistha Chatterjee. Platform and Model Design for Responsible AI: Design and build resilient, private, fair, and transparent machine learning models. Packt Publishing Ltd, 2023.Mi, Yuxi, et al. "Flexible Differentially Private Vertical Federated Learning with Adaptive Feature Embeddings." arXiv preprint arXiv:2308.02362 (2023).Mohammadi, Mohammadreza, et al. "Privacy-preserving Federated Learning System for Fatigue Detection." 2023 IEEE International Conference on Cyber Security and Resilience (CSR). IEEE, 2023.Contactwelcome2aijack[@]gmail.com