docstr: This attack was originally proposed by Carlini and Wagner. It is an
  iterative attack that finds adversarial examples on many defenses that
  are robust to other attacks.
  Paper link: https://arxiv.org/abs/1608.04644
  At a high level, this attack is an iterative attack using Adam and
  a specially-chosen loss function to find adversarial examples with
  lower distortion than other attacks. This comes at the cost of speed,
  as this attack is often much slower than others.
  
  :param model_fn: a callable that takes an input tensor and returns the model logits.
  :param y: (optional) Tensor with target labels.
  :param targeted: (optional) Targeted attack?
  :param batch_size (optional): Number of attacks to run simultaneously.
  :param clip_min: (optional) float. Minimum float values for adversarial example components.
  :param clip_max: (optional) float. Maximum float value for adversarial example components.
  :param binary_search_steps (optional): The number of times we perform binary
                          search to find the optimal tradeoff-
                          constant between norm of the purturbation
                          and confidence of the classification.
  :param max_iterations (optional): The maximum number of iterations. Setting this
                         to a larger value will produce lower distortion
                         results. Using only a few iterations requires
                         a larger learning rate, and will produce larger
                         distortion results.
  :param abort_early (optional): If true, allows early aborts if gradient descent
                  is unable to make progress (i.e., gets stuck in
                  a local minimum).
  :param confidence (optional): Confidence of adversarial examples: higher produces
                     examples with larger l2 distortion, but more
                     strongly classified as adversarial.
  :param initial_const (optional): The initial tradeoff-constant used to tune the
                    relative importance of the size of the perturbation
                    and confidence of classification.
                    If binary_search_steps is large, the initial
                    constant is not important. A smaller value of
                    this constant gives lower distortion results.
  :param learning_rate (optional): The learning rate for the attack algorithm.
                    Smaller values produce better results but are
                    slower to converge.
docstr_tok: ["This","attack","was","originally","proposed","by","Carlini","and","Wagner",".","It","is","an","iterative","attack","that","finds","adversarial","examples","on","many","defenses","that","are","robust","to","other","attacks",".","Paper","link",":","https",":","\/\/arxiv.org\/abs\/1608.04644","At","a","high","level",",","this","attack","is","an","iterative","attack","using","Adam","and","a","specially-chosen","loss","function","to","find","adversarial","examples","with","lower","distortion","than","other","attacks",".","This","comes","at","the","cost","of","speed",",","as","this","attack","is","often","much","slower","than","others",".",":","param","model_fn",":","a","callable","that","takes","an","input","tensor","and","returns","the","model","logits",".",":","param","y",":","(","optional",")","Tensor","with","target","labels",".",":","param","targeted",":","(","optional",")","Targeted","attack","?",":","param","batch_size","(","optional",")",":","Number","of","attacks","to","run","simultaneously",".",":","param","clip_min",":","(","optional",")","float",".","Minimum","float","values","for","adversarial","example","components",".",":","param","clip_max",":","(","optional",")","float",".","Maximum","float","value","for","adversarial","example","components",".",":","param","binary_search_steps","(","optional",")",":","The","number","of","times","we","perform","binary","search","to","find","the","optimal","tradeoff-","constant","between","norm","of","the","purturbation","and","confidence","of","the","classification",".",":","param","max_iterations","(","optional",")",":","The","maximum","number","of","iterations",".","Setting","this","to","a","larger","value","will","produce","lower","distortion","results",".","Using","only","a","few","iterations","requires","a","larger","learning","rate",",","and","will","produce","larger","distortion","results",".",":","param","abort_early","(","optional",")",":","If","true",",","allows","early","aborts","if","gradient","descent","is","unable","to","make","progress","(","i.e.",",","gets","stuck","in","a","local","minimum",")",".",":","param","confidence","(","optional",")",":","Confidence","of","adversarial","examples",":","higher","produces","examples","with","larger","l2","distortion",",","but","more","strongly","classified","as","adversarial",".",":","param","initial_const","(","optional",")",":","The","initial","tradeoff-constant","used","to","tune","the","relative","importance","of","the","size","of","the","perturbation","and","confidence","of","classification",".","If","binary_search_steps","is","large",",","the","initial","constant","is","not","important",".","A","smaller","value","of","this","constant","gives","lower","distortion","results",".",":","param","learning_rate","(","optional",")",":","The","learning","rate","for","the","attack","algorithm",".","Smaller","values","produce","better","results","but","are","slower","to","converge","."]
code: def __init__(
      self,
      model_fn,
      y=None,
      targeted=False,
      batch_size=128,
      clip_min=0.0,
      clip_max=1.0,
      binary_search_steps=5,
      max_iterations=1_000,
      abort_early=True,
      confidence=0.0,
      initial_const=1e-2,
      learning_rate=5e-3,
  ):
      """
      This attack was originally proposed by Carlini and Wagner. It is an
      iterative attack that finds adversarial examples on many defenses that
      are robust to other attacks.
      Paper link: https://arxiv.org/abs/1608.04644
      At a high level, this attack is an iterative attack using Adam and
      a specially-chosen loss function to find adversarial examples with
      lower distortion than other attacks. This comes at the cost of speed,
      as this attack is often much slower than others.
  
      :param model_fn: a callable that takes an input tensor and returns the model logits.
      :param y: (optional) Tensor with target labels.
      :param targeted: (optional) Targeted attack?
      :param batch_size (optional): Number of attacks to run simultaneously.
      :param clip_min: (optional) float. Minimum float values for adversarial example components.
      :param clip_max: (optional) float. Maximum float value for adversarial example components.
      :param binary_search_steps (optional): The number of times we perform binary
                              search to find the optimal tradeoff-
                              constant between norm of the purturbation
                              and confidence of the classification.
      :param max_iterations (optional): The maximum number of iterations. Setting this
                             to a larger value will produce lower distortion
                             results. Using only a few iterations requires
                             a larger learning rate, and will produce larger
                             distortion results.
      :param abort_early (optional): If true, allows early aborts if gradient descent
                      is unable to make progress (i.e., gets stuck in
                      a local minimum).
      :param confidence (optional): Confidence of adversarial examples: higher produces
                         examples with larger l2 distortion, but more
                         strongly classified as adversarial.
      :param initial_const (optional): The initial tradeoff-constant used to tune the
                        relative importance of the size of the perturbation
                        and confidence of classification.
                        If binary_search_steps is large, the initial
                        constant is not important. A smaller value of
                        this constant gives lower distortion results.
      :param learning_rate (optional): The learning rate for the attack algorithm.
                        Smaller values produce better results but are
                        slower to converge.
      """
      self.model_fn = model_fn
  
      self.batch_size = batch_size
  
      self.y = y
      self.targeted = y is not None
  
      self.clip_min = clip_min
      self.clip_max = clip_max
  
      self.binary_search_steps = binary_search_steps
      self.max_iterations = max_iterations
      self.abort_early = abort_early
      self.learning_rate = learning_rate
  
      self.confidence = confidence
      self.initial_const = initial_const
  
      # the optimizer
      self.optimizer = tf.keras.optimizers.Adam(self.learning_rate)
  
      super(CarliniWagnerL2, self).__init__()
  
file_path: cleverhans/cleverhans/tf2/attacks/carlini_wagner_l2.py
imports: import numpy
  import tensorflow
  from cleverhans.tf2.utils import get_or_guess_labels, set_with_mask
label_desc: Use image node_id 1 to create a new CarliniWagnerL2 object from inherited base classes: object with example: obj = CarliniWagnerL2(model_fn, y, targeted, batch_size, clip_min, clip_max, binary_search_steps, max_iterations, abort_early, confidence, initial_const, learning_rate)