The NOTA adapted attack files in this directory are adapted from the existing Adversarial Robustness Toolbox Version ART v1.11.0. These are typically implemented as a simple boolean, NOTA=True, with the default remaining the original attack.

In addition to NOTA adaptations, there are adaptation options available for stochastic versions of each attack, for use against Bayesian Neural Networks (i.e. calculating the expectation over transformation). The default behavior for each is the original deterministic behavior.

NOTA implementation is described in each file and matches what is in the paper.

Available NOTA Adapted Attacks:
- Carlini L_2
- Carlini L_inf
- AutoPGD Cross Entropy (CE)
- AutoPGD Difference Logits Ratio (DLR)
- AutoPGD Anti-NOTA (AN) 
- AutoAttack (with either NOTA-aware CE and NOTA-Aware DLR or NOTA-Aware AN and NOTA-Aware DLR)
- Deep Fool
- Square Attack


