I'm less familiar with poisoning, but at least for test-time robustness, the current benchmark for image classifiers is AutoAttack [0,1]. It's an ensemble of adaptive & parameter-free gradient-based white-box and gradient-free black-box attacks. Submitted academic work is typically considered incomplete without an evaluation on AA (and sometimes deepfool [2]). It's good to see that both are included in ART.

[0] https://arxiv.org/abs/2003.01690

[1] https://github.com/fra31/auto-attack

[2] https://arxiv.org/abs/1511.04599