class_docstr: Implements the Saliency Map Attack.
  The Jacobian-based Saliency Map Approach (Papernot et al. 2016).
  Paper link: https://arxiv.org/pdf/1511.07528.pdf
class_docstr_tok: ["Implements","the","Saliency","Map","Attack",".","The","Jacobian-based","Saliency","Map","Approach","(","Papernot","et","al",".","2016",")",".","Paper","link",":","https",":","\/\/arxiv.org\/pdf\/1511.07528.pdf"]
docstr: Apply the JSMA attack.
  Args:
      adversary(Adversary): The Adversary object.
      max_iter(int): The max iterations.
      fast(bool): Whether evaluate the pixel influence on sum of residual classes.
      theta(float): Perturbation per pixel relative to [min, max] range.
      max_perturbations_per_pixel(int): The max count of perturbation per pixel.
      two_pix(bool): Whether to select two pixels from salience map which 
          is used in original paper.
  Return:
      adversary: The Adversary object.
docstr_tok: ["Apply","the","JSMA","attack",".","Args",":","adversary","(","Adversary",")",":","The","Adversary","object",".","max_iter","(","int",")",":","The","max","iterations",".","fast","(","bool",")",":","Whether","evaluate","the","pixel","influence","on","sum","of","residual","classes",".","theta","(","float",")",":","Perturbation","per","pixel","relative","to","[","min",",","max","]","range",".","max_perturbations_per_pixel","(","int",")",":","The","max","count","of","perturbation","per","pixel",".","two_pix","(","bool",")",":","Whether","to","select","two","pixels","from","salience","map","which","is","used","in","original","paper",".","Return",":","adversary",":","The","Adversary","object","."]
code: def _apply(
      self,
      adversary,
      max_iter=2000,
      fast=True,
      theta=0.1,
      max_perturbations_per_pixel=7,
      two_pix=False,
  ):
      """
      Apply the JSMA attack.
      Args:
          adversary(Adversary): The Adversary object.
          max_iter(int): The max iterations.
          fast(bool): Whether evaluate the pixel influence on sum of residual classes.
          theta(float): Perturbation per pixel relative to [min, max] range.
          max_perturbations_per_pixel(int): The max count of perturbation per pixel.
          two_pix(bool): Whether to select two pixels from salience map which
              is used in original paper.
      Return:
          adversary: The Adversary object.
      """
      assert adversary is not None
  
      # 目前不支持双点
      two_pix = False
  
      if not adversary.is_targeted_attack or (
          adversary.target_label is None
      ):
          target_labels = self._generate_random_target(
              adversary.original_label
          )
      else:
          target_labels = [adversary.target_label]
  
      for target in target_labels:
          original_image = np.copy(adversary.original)
  
          # the mask defines the search domain
          # each modified pixel with border value is set to zero in mask
          mask = np.ones_like(original_image)
  
          # count tracks how often each pixel was changed
          counts = np.zeros_like(original_image)
  
          labels = list(range(self.model.num_classes()))
          adv_img = original_image.copy()
          min_, max_ = self.model.bounds()
  
          for step in range(max_iter):
              adv_img = np.clip(adv_img, min_, max_)
              logit = self.model.predict(adv_img)
              adv_label = np.argmax(logit)
              if adversary.try_accept_the_example(adv_img, adv_label):
                  return adversary
  
              # stop if mask is all zero
              if not any(mask.flatten()):
                  return adversary
  
              logging.info(
                  "step = {}, original_label = {}, adv_label={} target logit={}".format(
                      step,
                      adversary.original_label,
                      adv_label,
                      logit[adversary.target_label],
                  )
              )
  
              # get pixel location with highest influence on class
              idx, p_sign = self._saliency_map(
                  adv_img,
                  target,
                  labels,
                  mask,
                  fast=fast,
                  two_pix=two_pix,
              )
              if two_pix:
                  input_dimension = adv_img.shape[0]
                  idx = idx[0]
                  idx1 = idx // input_dimension
                  idx2 = idx % input_dimension
                  # apply perturbation
                  adv_img[idx1] += -p_sign * theta * (max_ - min_)
                  adv_img[idx2] += -p_sign * theta * (max_ - min_)
                  # tracks number of updates for each pixel
                  counts[idx1] += 1
                  counts[idx2] += 1
                  # remove pixel from search domain if it hits the bound
                  if adv_img[idx1] <= min_ or adv_img[idx1] >= max_:
                      mask[idx1] = 0
                  if adv_img[idx2] <= min_ or adv_img[idx2] >= max_:
                      mask[idx2] = 0
                  # remove pixel if it was changed too often
                  if counts[idx1] >= max_perturbations_per_pixel:
                      mask[idx1] = 0
                  if counts[idx2] >= max_perturbations_per_pixel:
                      mask[idx2] = 0
              else:
                  # apply perturbation
  
                  adv_img[idx] += p_sign * theta * (max_ - min_)
                  # tracks number of updates for each pixel
                  counts[idx] += 1
                  # remove pixel from search domain if it hits the bound
                  if adv_img[idx] <= min_ or adv_img[idx] >= max_:
                      logging.info(
                          "adv_img[idx] {} is over".format(adv_img[idx])
                      )
                      mask[idx] = 0
                  # remove pixel if it was changed too often
                  if counts[idx] >= max_perturbations_per_pixel:
                      logging.info(
                          "adv_img[idx] {} is over max_perturbations_per_pixel".format(
                              adv_img[idx]
                          )
                      )
                      mask[idx] = 0
  
              adv_img = np.clip(adv_img, min_, max_)
  
          # if attack remains unsuccessful within max iteration
          if step == max_iter - 1:
              return adversary
  
file_path: AdvBox/adversarialbox/attacks/saliency.py
imports: from __future__ import division
  from builtins import range
  import logging
  import random
  import numpy
  from .base import Attack
label_desc: Use image node_id 1 for calling the SaliencyMapAttack obj's underlying member method code with example usage: obj._apply(adversary, max_iter, fast, theta, max_perturbations_per_pixel, two_pix) and returns: adversary, adversary, adversary