<p><em>Will start with referencing the paper <a href="https://nicholas.carlini.com/papers/2017_sp_nnrobustattacks.pdf" rel="nofollow noreferrer">Towards Evaluating the Robustness
of Neural Networks</a> by Carlini from page2 last paragraph: <strong>the  adversary  has  complete access to a neural network, including the architecture and all paramaters, and can use this in a white-box manner.</strong> This is a conservative and realistic assumption: prior work has shown it is possible to train a substitute model given black-box access to  a  target  model,  and  by  attacking  the  substitute  model,  we can then transfer these attacks to the target model.</em></p>

<p><strong><em>Making the following 2 definitions, as follow, true:</em></strong></p>

<p><strong>White-Box:</strong> Attackers know full knowledge about the ML algorithm, ML model, (i.e ., parameters and hyperparameters), architecture, etc. Figure below does show an example how does work white-box attacks:</p>

<p><a href="https://i.stack.imgur.com/yr0mO.jpg" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/yr0mO.jpg" alt="GAN white-box model architecture"></a></p>

<p><strong>Black-Box:</strong> Attackers almost know nothing about the ML system 
(perhaps know number of features, ML algorithm). Figure below points steps as an example:</p>

<p><a href="https://i.stack.imgur.com/bgdjk.jpg" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/bgdjk.jpg" alt="GAN black-box model architecture"></a></p>

<p>Section 3.4 DEMONSTRATION OF BLACK  BOX ADVERSARIAL ATTACK IN THE PHYSICAL WORLD from paper <a href="https://arxiv.org/pdf/1607.02533.pdf" rel="nofollow noreferrer">ADVERSARIAL EXAMPLES IN THE PHYSICAL WORLD</a>by Kurakin, 2017 states the following: 
<strong>Paragraph 1 page 9 describe white-box meaning:</strong> <strong>The experiments described above study physical adversarial examples under the assumption that adversary has full access to the model (i.e. the adversary knows the architecture, model weights, etc . . . ).</strong> </p>

<p><strong>And following with explanation of the black-box meaning:</strong> <strong>However, the black box scenario, in which the attacker does not have access to the model, is a more realistic model of many security threats.</strong> </p>

<blockquote>
  <p><strong>Conclusion:</strong> In order to define/label/classify the algorithms as white-box/black-box you just change the settings for the model. </p>
</blockquote>

<p><strong>Note:</strong> I don't classify each algorithm because some of the algorithms can support only white-box settings or only black-box settings in the <a href="https://github.com/tensorflow/cleverhans" rel="nofollow noreferrer">cleverhans</a>library but is good start for you (if you do research than you need to check every single paper listed in the documentation to understand the GAN so you can generate on your own adversarial examples.</p>

<p>Resources used and interesting papers:</p>

<ol>
<li>BasicIterativeMethod: <a href="https://arxiv.org/pdf/1607.02533.pdf" rel="nofollow noreferrer">BasicIterativeMethod</a></li>
<li>CarliniWagnerL2:  <a href="https://arxiv.org/pdf/1608.04644.pdf" rel="nofollow noreferrer">CarliniWagnerL2</a></li>
<li>FastGradientMethod: <a href="https://arxiv.org/pdf/1412.6572.pdf" rel="nofollow noreferrer">https://arxiv.org/pdf/1412.6572.pdf</a> <a href="https://arxiv.org/pdf/1611.01236.pdf" rel="nofollow noreferrer">https://arxiv.org/pdf/1611.01236.pdf</a> <a href="https://arxiv.org/pdf/1611.01236.pdf" rel="nofollow noreferrer">https://arxiv.org/pdf/1611.01236.pdf</a></li>
<li>SaliencyMapMethod: <a href="https://arxiv.org/pdf/1511.07528.pdf" rel="nofollow noreferrer">SaliencyMapMethod</a></li>
<li>VirtualAdversarialMethod: <a href="https://arxiv.org/pdf/1507.00677.pdf" rel="nofollow noreferrer">VirtualAdversarialMethod</a></li>
<li>Fgsm Fast Gradient Sign Method: <a href="https://arxiv.org/pdf/1611.01236.pdf" rel="nofollow noreferrer">Fgsm Fast Gradient Sign Method</a></li>
<li>Jsma Jacobian-based saliency map approach:<a href="https://arxiv.org/pdf/1511.07528.pdf" rel="nofollow noreferrer">JSMA in white-box setting</a></li>
<li>Vatm virtual adversarial training: <a href="https://arxiv.org/pdf/1507.00677.pdf" rel="nofollow noreferrer">Vatm virtual adversarial training</a> </li>
<li><a href="https://ece.umd.edu/~danadach/Security_Fall_17/aml.pdf" rel="nofollow noreferrer">Adversarial Machine Learning
—
An Introduction
With slides from: 
Binghui
Wang</a></li>
<li><a href="https://github.com/tensorflow/cleverhans/blob/master/cleverhans_tutorials/mnist_blackbox.py" rel="nofollow noreferrer">mnist_blackbox</a></li>
<li><a href="https://github.com/tensorflow/cleverhans/blob/master/cleverhans_tutorials/mnist_tutorial_cw.py" rel="nofollow noreferrer">mnist_tutorial_cw</a></li>
</ol>
which attack in cleverhans is grey box attack and which is white/black box attack in cleverhans library?
<p>I use <a href="https://github.com/tensorflow/cleverhans" rel="nofollow noreferrer">https://github.com/tensorflow/cleverhans</a> to generate adversarial images, but the categories of attack algoritm is not provided.</p>

<p>All the attack algorithm codes are listed here: <a href="https://github.com/tensorflow/cleverhans/tree/master/cleverhans/attacks" rel="nofollow noreferrer">https://github.com/tensorflow/cleverhans/tree/master/cleverhans/attacks</a></p>

<p>I don't know which of these attack algorithm is grey box attack and which is white or black attack algorithm?</p>

<p>Because I need the category of algorithm to reasearch the attack defense algorithm.
The github page doesn't provide any information about this. How should I know?</p>