class_docstr: This module implements the Functionally Equivalent Extraction attack for neural networks with two dense layers,
  ReLU activation at the first layer and logits output after the second layer.
  
  | Paper link: https://arxiv.org/abs/1909.01838
class_docstr_tok: ["This","module","implements","the","Functionally","Equivalent","Extraction","attack","for","neural","networks","with","two","dense","layers",",","ReLU","activation","at","the","first","layer","and","logits","output","after","the","second","layer",".","|","Paper","link",":","https",":","\/\/arxiv.org\/abs\/1909.01838"]
docstr: Extract the targeted model.
  
  :param x: Samples of input data of shape (num_samples, num_features).
  :param y: Correct labels or target labels for `x`, depending if the attack is targeted
         or not. This parameter is only used by some of the attacks.
  :param delta_0: Initial step size of binary search.
  :param fraction_true: Fraction of output predictions that have to fulfill criteria for critical point.
  :param rel_diff_slope: Relative slope difference at critical points.
  :param rel_diff_value: Relative value difference at critical points.
  :param delta_init_value: Initial delta of weight value search.
  :param delta_value_max: Maximum delta  of weight value search.
  :param d2_min: Minimum acceptable value of sum of absolute second derivatives.
  :param d_step:  Step size of delta increase.
  :param delta_sign: Delta of weight sign search.
  :param unit_vector_scale: Multiplicative scale of the unit vector `e_j`.
  :param ftol: Tolerance for termination by the change of the cost function.
  :return: ART :class:`.BlackBoxClassifier` of the extracted model.
docstr_tok: ["Extract","the","targeted","model",".",":","param","x",":","Samples","of","input","data","of","shape","(","num_samples",",","num_features",")",".",":","param","y",":","Correct","labels","or","target","labels","for","`","x","`",",","depending","if","the","attack","is","targeted","or","not",".","This","parameter","is","only","used","by","some","of","the","attacks",".",":","param","delta_0",":","Initial","step","size","of","binary","search",".",":","param","fraction_true",":","Fraction","of","output","predictions","that","have","to","fulfill","criteria","for","critical","point",".",":","param","rel_diff_slope",":","Relative","slope","difference","at","critical","points",".",":","param","rel_diff_value",":","Relative","value","difference","at","critical","points",".",":","param","delta_init_value",":","Initial","delta","of","weight","value","search",".",":","param","delta_value_max",":","Maximum","delta","of","weight","value","search",".",":","param","d2_min",":","Minimum","acceptable","value","of","sum","of","absolute","second","derivatives",".",":","param","d_step",":","Step","size","of","delta","increase",".",":","param","delta_sign",":","Delta","of","weight","sign","search",".",":","param","unit_vector_scale",":","Multiplicative","scale","of","the","unit","vector","`","e_j","`",".",":","param","ftol",":","Tolerance","for","termination","by","the","change","of","the","cost","function",".",":","return",":","ART",":","class",":","`",".BlackBoxClassifier","`","of","the","extracted","model","."]
code: def extract(  # pylint: disable=W0221
      self,
      x: np.ndarray,
      y: Optional[np.ndarray] = None,
      delta_0: float = 0.05,
      fraction_true: float = 0.3,
      rel_diff_slope: float = 0.00001,
      rel_diff_value: float = 0.000001,
      delta_init_value: float = 0.1,
      delta_value_max: int = 50,
      d2_min: float = 0.0004,
      d_step: float = 0.01,
      delta_sign: float = 0.02,
      unit_vector_scale: int = 10000,
      ftol: float = 1e-8,
      **kwargs,
  ) -> BlackBoxClassifier:
      """
      Extract the targeted model.
  
      :param x: Samples of input data of shape (num_samples, num_features).
      :param y: Correct labels or target labels for `x`, depending if the attack is targeted
             or not. This parameter is only used by some of the attacks.
      :param delta_0: Initial step size of binary search.
      :param fraction_true: Fraction of output predictions that have to fulfill criteria for critical point.
      :param rel_diff_slope: Relative slope difference at critical points.
      :param rel_diff_value: Relative value difference at critical points.
      :param delta_init_value: Initial delta of weight value search.
      :param delta_value_max: Maximum delta  of weight value search.
      :param d2_min: Minimum acceptable value of sum of absolute second derivatives.
      :param d_step:  Step size of delta increase.
      :param delta_sign: Delta of weight sign search.
      :param unit_vector_scale: Multiplicative scale of the unit vector `e_j`.
      :param ftol: Tolerance for termination by the change of the cost function.
      :return: ART :class:`.BlackBoxClassifier` of the extracted model.
      """
      self._critical_point_search(
          delta_0=delta_0,
          fraction_true=fraction_true,
          rel_diff_slope=rel_diff_slope,
          rel_diff_value=rel_diff_value,
      )
      self._weight_recovery(
          delta_init_value=delta_init_value,
          delta_value_max=delta_value_max,
          d2_min=d2_min,
          d_step=d_step,
          delta_sign=delta_sign,
      )
      self._sign_recovery(
          unit_vector_scale=unit_vector_scale, ftol=ftol
      )
      self._last_layer_extraction(x, ftol)
  
      def predict(x: np.ndarray) -> np.ndarray:
          """
          Predict extracted model.
  
          :param x: Samples of input data of shape `(num_samples, num_features)`.
          :return: Predictions with the extracted model of shape `(num_samples, num_classes)`.
          """
          layer_0 = np.maximum(np.matmul(self.w_0.T, x.T) + self.b_0, 0.0)  # type: ignore
          layer_1 = np.matmul(self.w_1.T, layer_0) + self.b_1  # type: ignore
          return layer_1.T
  
      extracted_classifier = BlackBoxClassifier(
          predict,
          input_shape=self.estimator.input_shape,
          nb_classes=self.estimator.nb_classes,
          clip_values=self.estimator.clip_values,
          preprocessing_defences=self.estimator.preprocessing_defences,
          preprocessing=self.estimator.preprocessing,
      )
  
      return extracted_classifier
  
file_path: adversarial-robustness-toolbox/art/attacks/extraction/functionally_equivalent_extraction.py
imports: import logging
  import os
  from typing import List, Optional, TYPE_CHECKING
  import numpy
  from scipy.optimize import least_squares
  from art.attacks.attack import ExtractionAttack
  from art.estimators.estimator import BaseEstimator, NeuralNetworkMixin
  from art.estimators.classification.classifier import ClassifierMixin
  from art.estimators.classification.keras import KerasClassifier
  from art.estimators.classification.blackbox import BlackBoxClassifier
label_desc: Use image node_id 2 for calling the FunctionallyEquivalentExtraction obj's underlying member method code with example usage: obj.extract(x, y, delta_0, fraction_true, rel_diff_slope, rel_diff_value, delta_init_value, delta_value_max, d2_min, d_step, delta_sign, unit_vector_scale, ftol) and returns: extracted_classifier, layer_1