class_docstr: Implementation of Sleeper Agent Attack
  
  | Paper link: https://arxiv.org/pdf/2106.08970.pdf
class_docstr_tok: ["Implementation","of","Sleeper","Agent","Attack","|","Paper","link",":","https",":","\/\/arxiv.org\/pdf\/2106.08970.pdf"]
docstr: Initialize a Sleeper Agent poisoning attack.
  
  :param classifier: The proxy classifier used for the attack.
  :param percent_poison: The ratio of samples to poison among x_train, with range [0,1].
  :param patch: The patch to be applied as trigger.
  :param indices_target: The indices of training data having target label.
  :param epsilon: The L-inf perturbation budget.
  :param max_trials: The maximum number of restarts to optimize the poison.
  :param max_epochs: The maximum number of epochs to optimize the train per trial.
  :param learning_rate_schedule: The learning rate schedule to optimize the poison.
      A List of (learning rate, epoch) pairs. The learning rate is used
      if the current epoch is less than the specified epoch.
  :param batch_size: Batch size.
  :param clip_values: The range of the input features to the classifier.
  :param verbose: Show progress bars.
  :param patching_strategy: Patching strategy to be used for adding trigger, either random/fixed.
  :param selection_strategy: Selection strategy for getting the indices of
                       poison examples - either random/maximum gradient norm.
  :param retraining_factor: The factor for which retraining needs to be applied.
  :param model_retrain: True, if retraining has to be applied, else False.
  :param model_retraining_epoch: The epochs for which retraining has to be applied.
  :param class_source: The source class from which triggers were selected.
  :param class_target: The target label to which the poisoned model needs to misclassify.
  :param retrain_batch_size: Batch size required for model retraining.
docstr_tok: ["Initialize","a","Sleeper","Agent","poisoning","attack",".",":","param","classifier",":","The","proxy","classifier","used","for","the","attack",".",":","param","percent_poison",":","The","ratio","of","samples","to","poison","among","x_train",",","with","range","[","0,1","]",".",":","param","patch",":","The","patch","to","be","applied","as","trigger",".",":","param","indices_target",":","The","indices","of","training","data","having","target","label",".",":","param","epsilon",":","The","L-inf","perturbation","budget",".",":","param","max_trials",":","The","maximum","number","of","restarts","to","optimize","the","poison",".",":","param","max_epochs",":","The","maximum","number","of","epochs","to","optimize","the","train","per","trial",".",":","param","learning_rate_schedule",":","The","learning","rate","schedule","to","optimize","the","poison",".","A","List","of","(","learning","rate",",","epoch",")","pairs",".","The","learning","rate","is","used","if","the","current","epoch","is","less","than","the","specified","epoch",".",":","param","batch_size",":","Batch","size",".",":","param","clip_values",":","The","range","of","the","input","features","to","the","classifier",".",":","param","verbose",":","Show","progress","bars",".",":","param","patching_strategy",":","Patching","strategy","to","be","used","for","adding","trigger",",","either","random\/fixed",".",":","param","selection_strategy",":","Selection","strategy","for","getting","the","indices","of","poison","examples","-","either","random\/maximum","gradient","norm",".",":","param","retraining_factor",":","The","factor","for","which","retraining","needs","to","be","applied",".",":","param","model_retrain",":","True",",","if","retraining","has","to","be","applied",",","else","False",".",":","param","model_retraining_epoch",":","The","epochs","for","which","retraining","has","to","be","applied",".",":","param","class_source",":","The","source","class","from","which","triggers","were","selected",".",":","param","class_target",":","The","target","label","to","which","the","poisoned","model","needs","to","misclassify",".",":","param","retrain_batch_size",":","Batch","size","required","for","model","retraining","."]
code: def __init__(
      self,
      classifier: "CLASSIFIER_NEURALNETWORK_TYPE",
      percent_poison: float,
      patch: np.ndarray,
      indices_target: List[int],
      epsilon: float = 0.1,
      max_trials: int = 8,
      max_epochs: int = 250,
      learning_rate_schedule: Tuple[List[float], List[int]] = (
          [1e-1, 1e-2, 1e-3, 1e-4],
          [100, 150, 200, 220],
      ),
      batch_size: int = 128,
      clip_values: Tuple[float, float] = (0, 1.0),
      verbose: int = 1,
      patching_strategy: str = "random",
      selection_strategy: str = "random",
      retraining_factor: int = 1,
      model_retrain: bool = False,
      model_retraining_epoch: int = 1,
      class_source: int = 0,
      class_target: int = 1,
      device_name: str = "cpu",
      retrain_batch_size: int = 128,
  ):
      """
      Initialize a Sleeper Agent poisoning attack.
  
      :param classifier: The proxy classifier used for the attack.
      :param percent_poison: The ratio of samples to poison among x_train, with range [0,1].
      :param patch: The patch to be applied as trigger.
      :param indices_target: The indices of training data having target label.
      :param epsilon: The L-inf perturbation budget.
      :param max_trials: The maximum number of restarts to optimize the poison.
      :param max_epochs: The maximum number of epochs to optimize the train per trial.
      :param learning_rate_schedule: The learning rate schedule to optimize the poison.
          A List of (learning rate, epoch) pairs. The learning rate is used
          if the current epoch is less than the specified epoch.
      :param batch_size: Batch size.
      :param clip_values: The range of the input features to the classifier.
      :param verbose: Show progress bars.
      :param patching_strategy: Patching strategy to be used for adding trigger, either random/fixed.
      :param selection_strategy: Selection strategy for getting the indices of
                           poison examples - either random/maximum gradient norm.
      :param retraining_factor: The factor for which retraining needs to be applied.
      :param model_retrain: True, if retraining has to be applied, else False.
      :param model_retraining_epoch: The epochs for which retraining has to be applied.
      :param class_source: The source class from which triggers were selected.
      :param class_target: The target label to which the poisoned model needs to misclassify.
      :param retrain_batch_size: Batch size required for model retraining.
      """
      if isinstance(
          classifier.preprocessing,
          (
              StandardisationMeanStdPyTorch,
              StandardisationMeanStdTensorFlow,
          ),
      ):
          clip_values_normalised = (
              classifier.clip_values - classifier.preprocessing.mean  # type: ignore
          ) / classifier.preprocessing.std
          clip_values_normalised = (
              clip_values_normalised[0],
              clip_values_normalised[1],
          )
          epsilon_normalised = epsilon * (clip_values_normalised[1] - clip_values_normalised[0])  # type: ignore
          patch_normalised = (
              patch - classifier.preprocessing.mean
          ) / classifier.preprocessing.std
      else:
          raise ValueError(
              "classifier.preprocessing not an instance of pytorch/tensorflow"
          )
  
      super().__init__(
          classifier,
          percent_poison,
          epsilon_normalised,
          max_trials,
          max_epochs,
          learning_rate_schedule,
          batch_size,
          clip_values_normalised,
          verbose,
      )
      self.indices_target = indices_target
      self.selection_strategy = selection_strategy
      self.patching_strategy = patching_strategy
      self.retraining_factor = retraining_factor
      self.model_retrain = model_retrain
      self.model_retraining_epoch = model_retraining_epoch
      self.indices_poison: np.ndarray
      self.patch = patch_normalised
      self.class_target = class_target
      self.class_source = class_source
      self.device_name = device_name
      self.initial_epoch = 0
      self.retrain_batch_size = retrain_batch_size
  
imports: from __future__ import absolute_import, division, print_function, unicode_literals
  import logging
  from typing import Tuple, TYPE_CHECKING, List, Union
  import random
  import numpy
  from tqdm.auto import trange
  from art.attacks.poisoning.gradient_matching_attack import GradientMatchingAttack
  from art.estimators.classification.pytorch import PyTorchClassifier
  from art.estimators.classification import TensorFlowV2Classifier
  from art.preprocessing.standardisation_mean_std.pytorch import StandardisationMeanStdPyTorch
  from art.preprocessing.standardisation_mean_std.tensorflow import StandardisationMeanStdTensorFlow
label_desc: Use image node_id 1 to create a new SleeperAgentAttack object from inherited base classes: GradientMatchingAttack with example: obj = SleeperAgentAttack(classifier, percent_poison, patch, indices_target, epsilon, max_trials, max_epochs, learning_rate_schedule, batch_size, clip_values, verbose, patching_strategy, selection_strategy, retraining_factor, model_retrain, model_retraining_epoch, class_source, class_target, device_name, retrain_batch_size)