class_docstr: Implementation of a simple black-box attribute inference attack.
  
  The idea is to train a simple neural network to learn the attacked feature from the rest of the features and the
  model's predictions. Assumes the availability of the attacked model's predictions for the samples under attack,
  in addition to the rest of the feature values. If this is not available, the true class label of the samples may be
  used as a proxy.
class_docstr_tok: ["Implementation","of","a","simple","black-box","attribute","inference","attack",".","The","idea","is","to","train","a","simple","neural","network","to","learn","the","attacked","feature","from","the","rest","of","the","features","and","the","model","'s","predictions",".","Assumes","the","availability","of","the","attacked","model","'s","predictions","for","the","samples","under","attack",",","in","addition","to","the","rest","of","the","feature","values",".","If","this","is","not","available",",","the","true","class","label","of","the","samples","may","be","used","as","a","proxy","."]
docstr: Create an AttributeInferenceBlackBox attack instance.
  
  :param estimator: Target estimator.
  :param attack_model_type: the type of default attack model to train, optional. Should be one of:
                           `nn` (neural network, default),
                           `rf` (random forest),
                           `gb` (gradient boosting),
                           `lr` (logistic/linear regression),
                           `dt` (decision tree),
                           `knn` (k nearest neighbors),
                           `svm` (support vector machine).
                            If `attack_model` is supplied, this option will be ignored.
  :param attack_model: The attack model to train, optional. If the attacked feature is continuous, this should
                       be a regression model, and if the attacked feature is categorical it should be a
                       classifier.If none is provided, a default model will be created.
  :param attack_feature: The index of the feature to be attacked or a slice representing multiple indexes in
                         case of a one-hot encoded feature.
  :param is_continuous: Whether the attacked feature is continuous. Default is False (which means categorical).
  :param scale_range: If supplied, the class labels (both true and predicted) will be scaled to the given range.
                      Only applicable when `estimator` is a regressor.
  :param prediction_normal_factor: If supplied, the class labels (both true and predicted) are multiplied by the
                                   factor when used as inputs to the attack-model. Only applicable when
                                   `estimator` is a regressor and if `scale_range` is not supplied
  :param non_numerical_features: a list of feature indexes that require encoding in order to feed into an ML model
                                 (i.e., strings), not including the attacked feature. Should only be supplied if
                                 non-numeric features exist in the input data not including the attacked feature,
                                 and an encoder is not supplied.
  :param encoder: An already fit encoder that can be applied to the model's input features without the attacked
                  feature (i.e., should be fit for n-1 features).
  :param nn_model_epochs: the number of epochs to use when training a nn attack model
  :param nn_model_batch_size: the batch size to use when training a nn attack model
  :param nn_model_learning_rate: the learning rate to use when training a nn attack model
docstr_tok: ["Create","an","AttributeInferenceBlackBox","attack","instance",".",":","param","estimator",":","Target","estimator",".",":","param","attack_model_type",":","the","type","of","default","attack","model","to","train",",","optional",".","Should","be","one","of",":","`","nn","`","(","neural","network",",","default",")",",","`","rf","`","(","random","forest",")",",","`","gb","`","(","gradient","boosting",")",",","`","lr","`","(","logistic\/linear","regression",")",",","`","dt","`","(","decision","tree",")",",","`","knn","`","(","k","nearest","neighbors",")",",","`","svm","`","(","support","vector","machine",")",".","If","`","attack_model","`","is","supplied",",","this","option","will","be","ignored",".",":","param","attack_model",":","The","attack","model","to","train",",","optional",".","If","the","attacked","feature","is","continuous",",","this","should","be","a","regression","model",",","and","if","the","attacked","feature","is","categorical","it","should","be","a","classifier.If","none","is","provided",",","a","default","model","will","be","created",".",":","param","attack_feature",":","The","index","of","the","feature","to","be","attacked","or","a","slice","representing","multiple","indexes","in","case","of","a","one-hot","encoded","feature",".",":","param","is_continuous",":","Whether","the","attacked","feature","is","continuous",".","Default","is","False","(","which","means","categorical",")",".",":","param","scale_range",":","If","supplied",",","the","class","labels","(","both","true","and","predicted",")","will","be","scaled","to","the","given","range",".","Only","applicable","when","`","estimator","`","is","a","regressor",".",":","param","prediction_normal_factor",":","If","supplied",",","the","class","labels","(","both","true","and","predicted",")","are","multiplied","by","the","factor","when","used","as","inputs","to","the","attack-model",".","Only","applicable","when","`","estimator","`","is","a","regressor","and","if","`","scale_range","`","is","not","supplied",":","param","non_numerical_features",":","a","list","of","feature","indexes","that","require","encoding","in","order","to","feed","into","an","ML","model","(","i.e.",",","strings",")",",","not","including","the","attacked","feature",".","Should","only","be","supplied","if","non-numeric","features","exist","in","the","input","data","not","including","the","attacked","feature",",","and","an","encoder","is","not","supplied",".",":","param","encoder",":","An","already","fit","encoder","that","can","be","applied","to","the","model","'s","input","features","without","the","attacked","feature","(","i.e.",",","should","be","fit","for","n-1","features",")",".",":","param","nn_model_epochs",":","the","number","of","epochs","to","use","when","training","a","nn","attack","model",":","param","nn_model_batch_size",":","the","batch","size","to","use","when","training","a","nn","attack","model",":","param","nn_model_learning_rate",":","the","learning","rate","to","use","when","training","a","nn","attack","model"]
code: def __init__(
      self,
      estimator: Union["CLASSIFIER_TYPE", "REGRESSOR_TYPE"],
      attack_model_type: str = "nn",
      attack_model: Optional[
          Union["CLASSIFIER_TYPE", "REGRESSOR_TYPE"]
      ] = None,
      attack_feature: Union[int, slice] = 0,
      is_continuous: Optional[bool] = False,
      scale_range: Optional[Tuple[float, float]] = None,
      prediction_normal_factor: Optional[float] = 1,
      non_numerical_features: Optional[List[int]] = None,
      encoder: Optional[
          Union[OrdinalEncoder, OneHotEncoder, ColumnTransformer]
      ] = None,
      nn_model_epochs: int = 100,
      nn_model_batch_size: int = 100,
      nn_model_learning_rate: float = 0.0001,
  ):
      """
      Create an AttributeInferenceBlackBox attack instance.
  
      :param estimator: Target estimator.
      :param attack_model_type: the type of default attack model to train, optional. Should be one of:
                               `nn` (neural network, default),
                               `rf` (random forest),
                               `gb` (gradient boosting),
                               `lr` (logistic/linear regression),
                               `dt` (decision tree),
                               `knn` (k nearest neighbors),
                               `svm` (support vector machine).
                                If `attack_model` is supplied, this option will be ignored.
      :param attack_model: The attack model to train, optional. If the attacked feature is continuous, this should
                           be a regression model, and if the attacked feature is categorical it should be a
                           classifier.If none is provided, a default model will be created.
      :param attack_feature: The index of the feature to be attacked or a slice representing multiple indexes in
                             case of a one-hot encoded feature.
      :param is_continuous: Whether the attacked feature is continuous. Default is False (which means categorical).
      :param scale_range: If supplied, the class labels (both true and predicted) will be scaled to the given range.
                          Only applicable when `estimator` is a regressor.
      :param prediction_normal_factor: If supplied, the class labels (both true and predicted) are multiplied by the
                                       factor when used as inputs to the attack-model. Only applicable when
                                       `estimator` is a regressor and if `scale_range` is not supplied
      :param non_numerical_features: a list of feature indexes that require encoding in order to feed into an ML model
                                     (i.e., strings), not including the attacked feature. Should only be supplied if
                                     non-numeric features exist in the input data not including the attacked feature,
                                     and an encoder is not supplied.
      :param encoder: An already fit encoder that can be applied to the model's input features without the attacked
                      feature (i.e., should be fit for n-1 features).
      :param nn_model_epochs: the number of epochs to use when training a nn attack model
      :param nn_model_batch_size: the batch size to use when training a nn attack model
      :param nn_model_learning_rate: the learning rate to use when training a nn attack model
      """
      super().__init__(
          estimator=estimator, attack_feature=attack_feature
      )
  
      self._values: list = []
      self._attack_model_type: Optional[str] = attack_model_type
      self._encoder = encoder
      self._non_numerical_features = non_numerical_features
      self._is_continuous = is_continuous
      self.attack_model: Optional[Any] = None
      self.prediction_normal_factor = prediction_normal_factor
      self.scale_range = scale_range
      self.epochs = nn_model_epochs
      self.batch_size = nn_model_batch_size
      self.learning_rate = nn_model_learning_rate
  
      self._check_params()
  
      if attack_model:
          if self._is_continuous:
              if RegressorMixin not in type(attack_model).__mro__:
                  raise ValueError(
                      "When attacking a continuous feature the attack model must be of type Regressor."
                  )
          elif ClassifierMixin not in type(attack_model).__mro__:
              raise ValueError(
                  "When attacking a categorical feature the attack model must be of type Classifier."
              )
          self.attack_model = attack_model
          self._attack_model_type = None
      elif attack_model_type == "rf":
          if self._is_continuous:
              self.attack_model = RandomForestRegressor()
          else:
              self.attack_model = RandomForestClassifier()
      elif attack_model_type == "gb":
          if self._is_continuous:
              self.attack_model = GradientBoostingRegressor()
          else:
              self.attack_model = GradientBoostingClassifier()
      elif attack_model_type == "lr":
          if self._is_continuous:
              self.attack_model = LinearRegression()
          else:
              self.attack_model = LogisticRegression()
      elif attack_model_type == "dt":
          if self._is_continuous:
              self.attack_model = DecisionTreeRegressor()
          else:
              self.attack_model = DecisionTreeClassifier()
      elif attack_model_type == "knn":
          if self._is_continuous:
              self.attack_model = KNeighborsRegressor()
          else:
              self.attack_model = KNeighborsClassifier()
      elif attack_model_type == "svm":
          if self._is_continuous:
              self.attack_model = SVR()
          else:
              self.attack_model = SVC(probability=True)
      elif attack_model_type != "nn":
          raise ValueError(
              "Illegal value for parameter `attack_model_type`."
          )
  
      remove_attacked_feature(
          self.attack_feature, self._non_numerical_features
      )
  
imports: from __future__ import absolute_import, division, print_function, unicode_literals
  import logging
  from typing import Optional, Union, Tuple, List, Any, TYPE_CHECKING
  import numpy
  from sklearn.ensemble import RandomForestClassifier, RandomForestRegressor
  from sklearn.ensemble import GradientBoostingClassifier, GradientBoostingRegressor
  from sklearn.linear_model import LogisticRegression, LinearRegression
  from sklearn.neighbors import KNeighborsClassifier, KNeighborsRegressor
  from sklearn.tree import DecisionTreeClassifier, DecisionTreeRegressor
  from sklearn.svm import SVC, SVR
  from sklearn.preprocessing import minmax_scale, OneHotEncoder, OrdinalEncoder
  from sklearn.compose import ColumnTransformer
  from art.estimators.estimator import BaseEstimator
  from art.estimators.classification.classifier import ClassifierMixin
  from art.attacks.attack import AttributeInferenceAttack
  from art.estimators.regression import RegressorMixin
  from art.utils import check_and_transform_label_format, float_to_categorical, floats_to_one_hot, get_feature_values, remove_attacked_feature
label_desc: Use image node_id 1 to create a new AttributeInferenceBlackBox object from inherited base classes: AttributeInferenceAttack with example: obj = AttributeInferenceBlackBox(estimator, attack_model_type, attack_model, attack_feature, is_continuous, scale_range, prediction_normal_factor, non_numerical_features, encoder, nn_model_epochs, nn_model_batch_size, nn_model_learning_rate)