AIJack: A Simulator for Attacking and Defending Machine Learning Models

What AIJack is actually for

The README describes AIJack as a simulation tool for testing whether an AI system holds up against attackers. The framing matters. This is not a library you drop into a serving path to block adversarial inputs. It is a workbench where you construct an attack, point it at a model, and observe what happens. The intended user is someone who already knows what a poisoning attack or a membership inference attack is and wants a runnable implementation rather than a paper.

Two distinct audiences are served by the same repository. The first is the machine learning security researcher who wants to reproduce an attack against a PyTorch or scikit-learn model without writing the attack from scratch. The second is the person working on the defense side, who needs to know whether differential privacy, homomorphic encryption, k-anonymity or federated learning actually changes the outcome. The README lists all four as defense techniques and groups them with the attacks under one toolkit.

The scope claim is broad: more than 30 methods, spanning attack and defense, with a C++ backend and an MPI backend for federated learning. Broad scope is also the first thing to be skeptical about, because a single repository covering poisoning, backdoors, free-riders, model inversion and homomorphic encryption is unlikely to cover each of them to the same depth.

The Client, Server, API and Manager model

The architectural idea worth understanding is how AIJack handles distributed learning. The README gives four basic APIs: Client, Server, API and Manager. Client and Server represent the two sides of a distributed scheme. API is the thing you run: you register clients and servers with it and call run() to execute training. Manager is the extension point.

Manager is where the design gets interesting. Rather than subclassing a client or server to add an attack or a defense, you attach a manager to an existing class. The README shows a ClientManagerForAdditionalAbility and a ServerManagerForAdditionalAbility, each with an attach method that returns an extended class. You then instantiate the extended classes and pass them to the same API. The training loop does not change.

That indirection is what lets the same FedAVG training code host a malicious server. The README's example constructs a GradientInversionAttackServerManager with an input shape, calls attach on FedAVGServer, and builds the server from the returned class. The clients are ordinary FedAVGClient instances. From the outside the API call is identical to a clean run. In other words, the attack is a decorator over the server role, and the gradient inversion happens inside the server's normal participation in the protocol.

This is a cleaner separation than most research code manages. It also means the attack surface of the library itself is the attach mechanism: if a manager does not compose correctly with a given client or server implementation, the failure will look like a training bug rather than an attack bug.

Getting it installed without fighting the toolchain

The install path is short but has a native dependency that will stop you if you skip it. AIJack requires Boost and pybind11, and the README gives the sequence directly:

apt install -y libboost-all-dev pip install -U pip pip install "pybind11[global]" pip install aijack

If you want the latest version rather than the published wheel, the README offers a direct GitHub install with pip install git+https://github.com/Koukyosyumei/AIJack. A Dockerfile is also provided in the repository, which is the option to prefer if you do not want to reason about Boost versions on your host.

The pybind11[global] extra is not incidental. Because the performance-critical parts are C++, the package builds native extensions at install time, so a missing Boost development package produces a compile failure rather than a Python import error. That distinction matters when you are debugging: the traceback will point at a compiler invocation, not at aijack.

The last release listed is v0.0.1-beta.2 from January 2024, with earlier alphas and a beta from 2023. The version string is a fair warning about API stability. Anything you build against it should be pinned, and you should expect that method names and manager classes can move between releases.

Attacker is a thin wrapper, and that is the point

For non-distributed models, the interface is deliberately minimal. The README shows the abstract shape as an Attacker constructed around a target model, followed by a call to attack() that returns a result. The concrete example is a poisoning attack against a scikit-learn SVM:

from aijack.attack import Poison_attack_sklearn attacker = Poison_attack_sklearn(clf, X_train, y_train) malicious_data, log = attacker.attack(initial_data, 1, X_valid, y_valid)

Notice what the attack returns: modified training data, plus a log. The attacker does not mutate your model in place. It hands you a poisoned dataset that you then train on yourself. That is a sensible choice for a simulator, because it keeps the experiment explicit and lets you compare a clean training run against a poisoned one using the same model code.

The cost of that design is that the caller owns more of the experiment than the two-line abstract example suggests. You have to decide how to train on the returned data, how to evaluate it, and what the numeric argument in the middle of attack() means. The README does not explain that argument. This is the pattern throughout the documentation: the API shape is clear, the parameter semantics are left to the API reference.

AIValut is a separate product inside the same repository

AIValut is the part of AIJack that least resembles the rest of it. It is described as a simple DBMS for SQL-based algorithms, with its own storage engine and query parser, currently supporting Rain, a SQL-based debugging system for ML models. You train and debug models through SQL-like statements rather than Python.

The README's worked example is a bankruptcy classifier over age and debt. A Logreg statement trains logistic regression with a specified iteration count and learning rate, prints the trained parameters, and reports an AUC of 0.520000. Predictions are stored in a named table, prediction_on_training_data_lrmodel. The interesting query is Complaint, which removes records to satisfy a stated constraint. In the example, one record is removed so that the model predicts class 1 for samples with debt greater than or equal to 100, and the reported AUC after the fix is 1.000000.

That jump from 0.52 to 1.00 on the training data is the teaching moment, and it is also the trap. The README does not claim this generalizes. The Complaint operator is doing exactly what a data-cleaning tool does: it edits the training set until the model satisfies a constraint you wrote. Used as a debugging aid, that is useful. Used as a preprocessing step before a real deployment, it is a way to manufacture a model that agrees with your assumptions.

The README is explicit that AIValut should be used only for research purposes. The roadmap mentions future integration of k-anonymity, homomorphic encryption and differential privacy into AIValut, which means the privacy features listed at the top of the project are not all present in the SQL layer today.

Where AIJack is the wrong tool

The most important limitation is conceptual. A simulator that demonstrates an attack is not a defense. Running a model inversion attack against your own model tells you that the attack class is applicable; it does not tell you the attack will succeed in an adversary's hands with different data, different hyperparameters and a different query budget. The README's defense list (differential privacy, homomorphic encryption, k-anonymity, federated learning) describes techniques AIJack can simulate, not guarantees it can provide.

The second limitation is maturity. The release history stops at v0.0.1-beta.2 in early 2024, and the version numbering has not left the 0.0.1 line. For a library whose value is that its implementations match published methods, that is a real risk: you may need to read the source to confirm that a given attack follows the paper you care about.

The third is the dependency footprint. Boost plus pybind11 plus a C++ build step is heavier than a pure-Python research package, and it makes AIJack awkward to drop into a notebook environment that you do not control. If your work is confined to a managed Jupyter instance, the Dockerfile is the realistic route.

Finally, AIValut is not a general-purpose database. It has its own storage engine and parser, and the README frames it as supporting SQL-based debugging for ML models. Do not read it as a replacement for the database you already run.

How it compares to Adversarial Robustness Toolbox

The obvious alternative is IBM's Adversarial Robustness Toolbox, usually abbreviated ART. Both projects implement attacks and defenses against machine learning models, and both target PyTorch and scikit-learn style workflows. The difference in approach is where the abstraction sits.

ART organizes around estimators and wrappers: you wrap a classifier, then hand it to an attack object that knows how to query it. AIJack organizes around roles in a protocol. The Client, Server, API and Manager structure exists because AIJack treats federated learning and split learning as first-class settings, not as an afterthought. The gradient inversion example, where a manager is attached to a FedAVGServer so that the server itself becomes the attacker, has no clean equivalent in an estimator-wrapper design.

That makes AIJack the better fit if your question is about what a participant in a distributed training run can learn. ART is the better fit if your question is about a single model and a single input, and you want a wide catalogue of evasion and poisoning methods behind a uniform interface. AIJack's C++ backend and MPI support point in the same direction: distributed training scenarios are the design center, and the standard attacker API is the simpler companion to it.

Licence, maintenance and what to check before you depend on it

AIJack is Apache-2.0. That is a permissive licence with an explicit patent grant, which is generally the friendlier option for corporate use than a copyleft licence. It does not, however, remove the need to check the licences of the dependencies you pull in alongside it, particularly Boost and pybind11, and it says nothing about the terms of any dataset or model you point the attacks at. This is not legal advice; if the output of a simulation is going into a report or a product decision, have someone review the terms.

Maintenance cost is the practical question. The last push recorded for the repository is 2026-05-30, while the newest release is v0.0.1-beta.2 from 2024-01-01. That combination suggests active development on main with infrequent tagged releases. If you install from GitHub you get the current code; if you install from PyPI you get the tagged beta. Pick deliberately, and pin whichever you choose.

The upgrade path is the weak point. With the version still on 0.0.1, there is no stability contract to rely on, and the README's roadmap for AIValut implies features that are not there yet. Before adopting, verify two things against the API reference for your installed version: that the specific attack or defense you need is exported from aijack.attack or aijack.collaborative, and that the manager class for your distributed setting still has the attach method shown in the README. Those two checks take a few minutes and will save you from building on an example that has already moved.

Editorial conclusion

Adopt AIJack if you are a researcher or a security engineer who needs to reproduce a specific attack class, such as a gradient inversion against FedAVG, and you are comfortable installing Boost and pybind11 first. Do not adopt it as a runtime protection layer for a deployed model; the README itself frames the SQL component as research-only. Before committing, verify which of the listed 30-plus methods actually exist in the API reference for your version, and check whether the PyTorch and scikit-learn paths both build against your local toolchain.

Official sources

1. Koukyosyumei/AIJack on GitHub
2. License: Apache-2.0
3. Project website
4. README
5. Releases