class_docstr: Implements NAttack: https://arxiv.org/abs/1905.00441
  
  Disclaimers: Note that NAttack assumes the model outputs
  normalized probabilities.  Moreover, computations are broadcasted,
  so it is advisable to use smaller batch sizes when nb_samples is
  large.
  
  Hyperparams: sigma controls the variance for the generation of
  perturbations.
  
  :param predict: forward pass function.
  :param eps: maximum distortion.
  :param order: the order of maximum distortion (inf or 2)
  :param loss_fn: loss function (default None, NAttack uses CW loss)
  :param nb_samples: population size (default 100)
  :param nb_iter: number of iterations (default 40)
  :param eps_iter: attack step size (default 0.02)
  :param sigma: variance to control sample generation (default 0.1)
  :param clip_min: mininum value per input dimension (default 0.)
  :param clip_max: mininum value per input dimension (default 1.)
  :param targeted: if the attack is targeted (default False)
class_docstr_tok: ["Implements","NAttack",":","https",":","\/\/arxiv.org\/abs\/1905.00441","Disclaimers",":","Note","that","NAttack","assumes","the","model","outputs","normalized","probabilities",".","Moreover",",","computations","are","broadcasted",",","so","it","is","advisable","to","use","smaller","batch","sizes","when","nb_samples","is","large",".","Hyperparams",":","sigma","controls","the","variance","for","the","generation","of","perturbations",".",":","param","predict",":","forward","pass","function",".",":","param","eps",":","maximum","distortion",".",":","param","order",":","the","order","of","maximum","distortion","(","inf","or","2",")",":","param","loss_fn",":","loss","function","(","default","None",",","NAttack","uses","CW","loss",")",":","param","nb_samples",":","population","size","(","default","100",")",":","param","nb_iter",":","number","of","iterations","(","default","40",")",":","param","eps_iter",":","attack","step","size","(","default","0.02",")",":","param","sigma",":","variance","to","control","sample","generation","(","default","0.1",")",":","param","clip_min",":","mininum","value","per","input","dimension","(","default","0",".",")",":","param","clip_max",":","mininum","value","per","input","dimension","(","default","1",".",")",":","param","targeted",":","if","the","attack","is","targeted","(","default","False",")"]
code: def perturb(
      self, x: torch.FloatTensor, y: Optional[torch.Tensor] = None
  ) -> torch.FloatTensor:
      # [B, F]
      x, y = self._verify_and_process_inputs(x, y)
      shape, flat_x = _flatten(x)
      data_shape = tuple(shape[1:])
      n_batch, n_dim = flat_x.shape
  
      # [B]
      eps = _check_param(self.eps, x.new_full((x.shape[0],), 1), "eps")
      # [B, F]
      clip_min = _check_param(self.clip_min, flat_x, "clip_min")
      clip_max = _check_param(self.clip_max, flat_x, "clip_max")
  
      def f(x):
          new_shape = (x.shape[0],) + data_shape
          input = x.reshape(new_shape)
          return self.predict(input)
  
      projector = _make_projector(
          eps, self.order, flat_x, clip_min, clip_max
      )
  
      adv, _, losses = n_attack(
          predict_fn=f,
          loss_fn=self.loss_fn,
          x=flat_x,
          y=y,
          projector=projector,
          nb_samples=self.nb_samples,
          nb_iter=self.nb_iter,
          eps_iter=self.eps_iter,
          sigma=self.sigma,
          targeted=self.targeted,
      )
  
      adv = select_best_example(adv, losses)
      adv = adv.reshape(shape)
  
      return adv
  
imports: from math import inf
  from typing import Optional
  import torch
  import torch.nn.functional
  from advertorch.attacks.base import Attack
  from advertorch.attacks.base import LabelMixin
  from .utils import _check_param, _flatten, _make_projector
  from advertorch.utils import to_one_hot
label_desc: Use image node_id 2 for calling the NAttack obj's underlying member method code with example usage: obj.perturb(x, y) and returns: adv, self