class_docstr: Implementation of the attack from Hirano and Takemoto (2019). Computes a fixed perturbation to be applied to all
  future inputs. To this end, it can use any adversarial attack method.
  
  | Paper link: https://arxiv.org/abs/1911.06502
class_docstr_tok: ["Implementation","of","the","attack","from","Hirano","and","Takemoto","(","2019",")",".","Computes","a","fixed","perturbation","to","be","applied","to","all","future","inputs",".","To","this","end",",","it","can","use","any","adversarial","attack","method",".","|","Paper","link",":","https",":","\/\/arxiv.org\/abs\/1911.06502"]
docstr: :param classifier: A trained classifier.
  :param attacker: Adversarial attack name. Default is 'fgsm'. Supported names: 'simba'.
  :param attacker_params: Parameters specific to the adversarial attack. If this parameter is not specified,
                          the default parameters of the chosen attack will be used.
  :param delta: The maximum acceptable rate of correctly classified adversarial examples by the classifier.
                The attack will stop when the targeted success rate exceeds `(1 - delta)`.
                'delta' should be in the range `[0, 1]`.
  :param max_iter: The maximum number of iterations for computing universal perturbation.
  :param eps: The perturbation magnitude, which controls the strength of the universal perturbation applied
              to the input samples. A larger `eps` value will result in a more noticeable perturbation,
              potentially leading to higher attack success rates but also increasing the visual distortion
              in the generated adversarial examples. Default is `10.0`.
  :param norm: The norm of the adversarial perturbation. Possible values: "inf", np.inf, 2
docstr_tok: [":","param","classifier",":","A","trained","classifier",".",":","param","attacker",":","Adversarial","attack","name",".","Default","is","'fgsm","'",".","Supported","names",":","'simba","'",".",":","param","attacker_params",":","Parameters","specific","to","the","adversarial","attack",".","If","this","parameter","is","not","specified",",","the","default","parameters","of","the","chosen","attack","will","be","used",".",":","param","delta",":","The","maximum","acceptable","rate","of","correctly","classified","adversarial","examples","by","the","classifier",".","The","attack","will","stop","when","the","targeted","success","rate","exceeds","`","(","1","-","delta",")","`",".","'delta","'","should","be","in","the","range","`","[","0",",","1","]","`",".",":","param","max_iter",":","The","maximum","number","of","iterations","for","computing","universal","perturbation",".",":","param","eps",":","The","perturbation","magnitude",",","which","controls","the","strength","of","the","universal","perturbation","applied","to","the","input","samples",".","A","larger","`","eps","`","value","will","result","in","a","more","noticeable","perturbation",",","potentially","leading","to","higher","attack","success","rates","but","also","increasing","the","visual","distortion","in","the","generated","adversarial","examples",".","Default","is","`","10.0","`",".",":","param","norm",":","The","norm","of","the","adversarial","perturbation",".","Possible","values",":","``","inf","''",",","np.inf",",","2"]
code: def __init__(
      self,
      classifier: "CLASSIFIER_TYPE",
      attacker: str = "fgsm",
      attacker_params: Optional[Dict[str, Any]] = None,
      delta: float = 0.2,
      max_iter: int = 20,
      eps: float = 10.0,
      norm: Union[int, float, str] = np.inf,
  ):
      """
      :param classifier: A trained classifier.
      :param attacker: Adversarial attack name. Default is 'fgsm'. Supported names: 'simba'.
      :param attacker_params: Parameters specific to the adversarial attack. If this parameter is not specified,
                              the default parameters of the chosen attack will be used.
      :param delta: The maximum acceptable rate of correctly classified adversarial examples by the classifier.
                    The attack will stop when the targeted success rate exceeds `(1 - delta)`.
                    'delta' should be in the range `[0, 1]`.
      :param max_iter: The maximum number of iterations for computing universal perturbation.
      :param eps: The perturbation magnitude, which controls the strength of the universal perturbation applied
                  to the input samples. A larger `eps` value will result in a more noticeable perturbation,
                  potentially leading to higher attack success rates but also increasing the visual distortion
                  in the generated adversarial examples. Default is `10.0`.
      :param norm: The norm of the adversarial perturbation. Possible values: "inf", np.inf, 2
      """
      super().__init__(estimator=classifier)
  
      self.attacker = attacker
      self.attacker_params = attacker_params
      self.delta = delta
      self.max_iter = max_iter
      self.eps = eps
      self.norm = norm
      self._targeted = True
      self._check_params()
  
file_path: adversarial-robustness-toolbox/art/attacks/evasion/targeted_universal_perturbation.py
imports: from __future__ import absolute_import, division, print_function, unicode_literals
  import logging
  import random
  import types
  from typing import Any, Dict, Optional, Union, TYPE_CHECKING
  import numpy
  from art.attacks.attack import EvasionAttack
  from art.estimators.estimator import BaseEstimator
  from art.estimators.classification.classifier import ClassifierMixin
  from art.utils import projection
label_desc: Use image node_id 1 to create a new TargetedUniversalPerturbation object from inherited base classes: EvasionAttack with example: obj = TargetedUniversalPerturbation(classifier, attacker, attacker_params, delta, max_iter, eps, norm)