class_docstr: The Projected Gradient Descent attack is an iterative method in which, after each iteration, the perturbation is
  projected on an lp-ball of specified radius (in addition to clipping the values of the adversarial sample so that it
  lies in the permitted data range). This is the attack proposed by Madry et al. for adversarial training.
  
  | Paper link: https://arxiv.org/abs/1706.06083
class_docstr_tok: ["The","Projected","Gradient","Descent","attack","is","an","iterative","method","in","which",",","after","each","iteration",",","the","perturbation","is","projected","on","an","lp-ball","of","specified","radius","(","in","addition","to","clipping","the","values","of","the","adversarial","sample","so","that","it","lies","in","the","permitted","data","range",")",".","This","is","the","attack","proposed","by","Madry","et","al",".","for","adversarial","training",".","|","Paper","link",":","https",":","\/\/arxiv.org\/abs\/1706.06083"]
docstr: Compute adversarial examples for one iteration.
  
  :param x: Current adversarial examples.
  :param x_init: An array with the original inputs.
  :param y: Target values (class labels) one-hot-encoded of shape `(nb_samples, nb_classes)` or indices of shape
            (nb_samples,). Only provide this parameter if you'd like to use true labels when crafting adversarial
            samples. Otherwise, model predictions are used as labels to avoid the "label leaking" effect
            (explained in this paper: https://arxiv.org/abs/1611.01236).
  :param mask: An array with a mask broadcastable to input `x` defining where to apply adversarial perturbations.
               Shape needs to be broadcastable to the shape of x and can also be of the same shape as `x`. Any
               features for which the mask is zero will not be adversarially perturbed.
  :param eps: Maximum perturbation that the attacker can introduce.
  :param eps_step: Attack step size (input variation) at each iteration.
  :param random_init: Random initialisation within the epsilon ball. For random_init=False starting at the
                      original input.
  :return: Adversarial examples.
docstr_tok: ["Compute","adversarial","examples","for","one","iteration",".",":","param","x",":","Current","adversarial","examples",".",":","param","x_init",":","An","array","with","the","original","inputs",".",":","param","y",":","Target","values","(","class","labels",")","one-hot-encoded","of","shape","`","(","nb_samples",",","nb_classes",")","`","or","indices","of","shape","(","nb_samples",",",")",".","Only","provide","this","parameter","if","you","'d","like","to","use","true","labels","when","crafting","adversarial","samples",".","Otherwise",",","model","predictions","are","used","as","labels","to","avoid","the","``","label","leaking","''","effect","(","explained","in","this","paper",":","https",":","\/\/arxiv.org\/abs\/1611.01236",")",".",":","param","mask",":","An","array","with","a","mask","broadcastable","to","input","`","x","`","defining","where","to","apply","adversarial","perturbations",".","Shape","needs","to","be","broadcastable","to","the","shape","of","x","and","can","also","be","of","the","same","shape","as","`","x","`",".","Any","features","for","which","the","mask","is","zero","will","not","be","adversarially","perturbed",".",":","param","eps",":","Maximum","perturbation","that","the","attacker","can","introduce",".",":","param","eps_step",":","Attack","step","size","(","input","variation",")","at","each","iteration",".",":","param","random_init",":","Random","initialisation","within","the","epsilon","ball",".","For","random_init=False","starting","at","the","original","input",".",":","return",":","Adversarial","examples","."]
code: def _compute_pytorch(
      self,
      x: "torch.Tensor",
      x_init: "torch.Tensor",
      y: "torch.Tensor",
      mask: "torch.Tensor",
      eps: Union[int, float, np.ndarray],
      eps_step: Union[int, float, np.ndarray],
      random_init: bool,
      momentum: "torch.Tensor",
  ) -> "torch.Tensor":
      """
      Compute adversarial examples for one iteration.
  
      :param x: Current adversarial examples.
      :param x_init: An array with the original inputs.
      :param y: Target values (class labels) one-hot-encoded of shape `(nb_samples, nb_classes)` or indices of shape
                (nb_samples,). Only provide this parameter if you'd like to use true labels when crafting adversarial
                samples. Otherwise, model predictions are used as labels to avoid the "label leaking" effect
                (explained in this paper: https://arxiv.org/abs/1611.01236).
      :param mask: An array with a mask broadcastable to input `x` defining where to apply adversarial perturbations.
                   Shape needs to be broadcastable to the shape of x and can also be of the same shape as `x`. Any
                   features for which the mask is zero will not be adversarially perturbed.
      :param eps: Maximum perturbation that the attacker can introduce.
      :param eps_step: Attack step size (input variation) at each iteration.
      :param random_init: Random initialisation within the epsilon ball. For random_init=False starting at the
                          original input.
      :return: Adversarial examples.
      """
      import torch
  
      if random_init:
          n = x.shape[0]
          m = np.prod(x.shape[1:]).item()
  
          random_perturbation_array = (
              random_sphere(n, m, eps, self.norm)
              .reshape(x.shape)
              .astype(ART_NUMPY_DTYPE)
          )
          random_perturbation = torch.from_numpy(
              random_perturbation_array
          ).to(self.estimator.device)
  
          if mask is not None:
              random_perturbation = random_perturbation * mask
  
          x_adv = x + random_perturbation
  
          if self.estimator.clip_values is not None:
              clip_min, clip_max = self.estimator.clip_values
              x_adv = torch.max(
                  torch.min(
                      x_adv,
                      torch.tensor(clip_max).to(self.estimator.device),
                  ),
                  torch.tensor(clip_min).to(self.estimator.device),
              )
  
      else:
          x_adv = x
  
      # Get perturbation
      perturbation = self._compute_perturbation_pytorch(
          x_adv, y, mask, momentum
      )
  
      # Apply perturbation and clip
      x_adv = self._apply_perturbation_pytorch(
          x_adv, perturbation, eps_step
      )
  
      # Do projection
      perturbation = self._projection(x_adv - x_init, eps, self.norm)
  
      # Recompute x_adv
      x_adv = perturbation + x_init
  
      return x_adv
  
file_path: adversarial-robustness-toolbox/art/attacks/evasion/projected_gradient_descent/projected_gradient_descent_pytorch.py
imports: from __future__ import absolute_import, division, print_function, unicode_literals
  import logging
  from typing import Optional, Union, TYPE_CHECKING
  import numpy
  from tqdm.auto import tqdm
  from art.config import ART_NUMPY_DTYPE
  from art.summary_writer import SummaryWriter
  from art.estimators.estimator import BaseEstimator, LossGradientsMixin
  from art.estimators.classification.classifier import ClassifierMixin
  from art.attacks.evasion.projected_gradient_descent.projected_gradient_descent_numpy import ProjectedGradientDescentCommon
  from art.utils import compute_success, random_sphere, compute_success_array
label_desc: Use image node_id 6 for calling the ProjectedGradientDescentPyTorch obj's underlying member method code with example usage: obj._compute_pytorch(x, x_init, y, mask, eps, eps_step, random_init, momentum) and returns: x_adv