class_docstr: Implementation of Clean-Label Backdoor Attack introduced in Turner et al., 2018.
  
  Applies a number of backdoor perturbation functions and does not change labels.
  
  | Paper link: https://people.csail.mit.edu/madry/lab/cleanlabel.pdf
docstr: Creates a new Clean Label Backdoor poisoning attack
  
  :param backdoor: the backdoor chosen for this attack
  :param proxy_classifier: the classifier for this attack ideally it solves the same or similar classification
                           task as the original classifier
  :param target: The target label to poison
  :param pp_poison: The percentage of the data to poison. Note: Only data within the target label is poisoned
  :param norm: The norm of the adversarial perturbation supporting "inf", np.inf, 1 or 2.
  :param eps: Maximum perturbation that the attacker can introduce.
  :param eps_step: Attack step size (input variation) at each iteration.
  :param max_iter: The maximum number of iterations.
  :param num_random_init: Number of random initialisations within the epsilon ball. For num_random_init=0 starting
                          at the original input.
code: def __init__(
      self,
      backdoor: PoisoningAttackBackdoor,
      proxy_classifier: "CLASSIFIER_LOSS_GRADIENTS_TYPE",
      target: np.ndarray,
      pp_poison: float = 0.33,
      norm: Union[int, float, str] = np.inf,
      eps: float = 0.3,
      eps_step: float = 0.1,
      max_iter: int = 100,
      num_random_init: int = 0,
  ) -> None:
      """
      Creates a new Clean Label Backdoor poisoning attack
  
      :param backdoor: the backdoor chosen for this attack
      :param proxy_classifier: the classifier for this attack ideally it solves the same or similar classification
                               task as the original classifier
      :param target: The target label to poison
      :param pp_poison: The percentage of the data to poison. Note: Only data within the target label is poisoned
      :param norm: The norm of the adversarial perturbation supporting "inf", np.inf, 1 or 2.
      :param eps: Maximum perturbation that the attacker can introduce.
      :param eps_step: Attack step size (input variation) at each iteration.
      :param max_iter: The maximum number of iterations.
      :param num_random_init: Number of random initialisations within the epsilon ball. For num_random_init=0 starting
                              at the original input.
      """
      super().__init__()
      self.backdoor = backdoor
      self.proxy_classifier = proxy_classifier
      self.target = target
      self.pp_poison = pp_poison
      self.attack = ProjectedGradientDescent(
          proxy_classifier,
          norm=norm,
          eps=eps,
          eps_step=eps_step,
          max_iter=max_iter,
          targeted=False,
          num_random_init=num_random_init,
      )
      self._check_params()
  
file_path: adversarial-robustness-toolbox/art/attacks/poisoning/clean_label_backdoor_attack.py
imports: from __future__ import absolute_import, division, print_function, unicode_literals
  import logging
  from typing import Optional, Tuple, TYPE_CHECKING, Union
  import numpy
  from art.attacks.attack import PoisoningAttackBlackBox
  from art.attacks.evasion.projected_gradient_descent.projected_gradient_descent import ProjectedGradientDescent
  from art.attacks.poisoning.backdoor_attack import PoisoningAttackBackdoor
label_desc: Use image node_id 1 to create a new PoisoningAttackCleanLabelBackdoor object from inherited base classes: PoisoningAttackBlackBox with example: obj = PoisoningAttackCleanLabelBackdoor(backdoor, proxy_classifier, target, pp_poison, norm, eps, eps_step, max_iter, num_random_init)