code: def generate_backdoor(
      x_clean,
      y_clean,
      percent_poison,
      backdoor_type="pattern",
      sources=np.arange(10),
      targets=(np.arange(10) + 1) % 10,
  ):
      """
      Creates a backdoor in MNIST images by adding a pattern or pixel to the image and changing the label to a targeted
      class. Default parameters poison each digit so that it gets classified to the next digit.
  
      :param x_clean: Original raw data
      :type x_clean: `np.ndarray`
      :param y_clean: Original labels
      :type y_clean:`np.ndarray`
      :param percent_poison: After poisoning, the target class should contain this percentage of poison
      :type percent_poison: `float`
      :param backdoor_type: Backdoor type can be `pixel` or `pattern`.
      :type backdoor_type: `str`
      :param sources: Array that holds the source classes for each backdoor. Poison is
      generating by taking images from the source class, adding the backdoor trigger, and labeling as the target class.
      Poisonous images from sources[i] will be labeled as targets[i].
      :type sources: `np.ndarray`
      :param targets: This array holds the target classes for each backdoor. Poisonous images from sources[i] will be
                      labeled as targets[i].
      :type targets: `np.ndarray`
      :return: Returns is_poison, which is a boolean array indicating which points are poisonous, x_poison, which
      contains all of the data both legitimate and poisoned, and y_poison, which contains all of the labels
      both legitimate and poisoned.
      :rtype: `tuple`
      """
  
      max_val = np.max(x_clean)
  
      x_poison = np.copy(x_clean)
      y_poison = np.copy(y_clean)
      is_poison = np.zeros(np.shape(y_poison))
  
      for i, (src, tgt) in enumerate(zip(sources, targets)):
          n_points_in_tgt = np.size(np.where(y_clean == tgt))
          num_poison = round(
              (percent_poison * n_points_in_tgt) / (1 - percent_poison)
          )
          src_imgs = x_clean[y_clean == src]
  
          n_points_in_src = np.shape(src_imgs)[0]
          indices_to_be_poisoned = np.random.choice(
              n_points_in_src, num_poison
          )
  
          imgs_to_be_poisoned = np.copy(
              src_imgs[indices_to_be_poisoned]
          )
          if backdoor_type == "pattern":
              imgs_to_be_poisoned = add_pattern_bd(
                  x=imgs_to_be_poisoned, pixel_value=max_val
              )
          elif backdoor_type == "pixel":
              imgs_to_be_poisoned = add_single_bd(
                  imgs_to_be_poisoned, pixel_value=max_val
              )
          x_poison = np.append(x_poison, imgs_to_be_poisoned, axis=0)
          y_poison = np.append(
              y_poison, np.ones(num_poison) * tgt, axis=0
          )
          is_poison = np.append(is_poison, np.ones(num_poison))
  
      is_poison = is_poison != 0
  
      return is_poison, x_poison, y_poison
  
file_path: adversarial-robustness-toolbox/examples/mnist_poison_detection.py
imports: from __future__ import absolute_import, division, print_function, unicode_literals
  import pprint
  import json
  import tensorflow
  from keras.models import Sequential
  from keras.layers import Dense, Flatten, Conv2D, MaxPooling2D, Dropout
  import numpy
  from art.attacks.poisoning.perturbations.image_perturbations import add_pattern_bd, add_single_bd
  from art.estimators.classification import KerasClassifier
  from art.utils import load_mnist, preprocess
  from art.defences.detector.poison import ActivationDefence
label_desc: Use image node_id 2 for calling a global function with example usage: generate_backdoor(x_clean, y_clean, percent_poison, backdoor_type, sources, targets) and returns: is_poison,  x_poison,  y_poison