class_docstr: Implementation of the composite adversarial attack on image classifiers in PyTorch. The attack is constructed by
  adversarially perturbing the hue component of the inputs. It uses order scheduling to search for the attack sequence
  and uses the iterative gradient sign method to optimize the perturbations in semantic space and Lp-ball (see
  `FastGradientMethod` and `BasicIterativeMethod`).
  
  | Note that this attack is intended for only PyTorch image classifiers with RGB images in the range [0, 1] as inputs
  
  | Paper link: https://arxiv.org/abs/2202.04235
class_docstr_tok: ["Implementation","of","the","composite","adversarial","attack","on","image","classifiers","in","PyTorch",".","The","attack","is","constructed","by","adversarially","perturbing","the","hue","component","of","the","inputs",".","It","uses","order","scheduling","to","search","for","the","attack","sequence","and","uses","the","iterative","gradient","sign","method","to","optimize","the","perturbations","in","semantic","space","and","Lp-ball","(","see","`","FastGradientMethod","`","and","`","BasicIterativeMethod","`",")",".","|","Note","that","this","attack","is","intended","for","only","PyTorch","image","classifiers","with","RGB","images","in","the","range","[","0",",","1","]","as","inputs","|","Paper","link",":","https",":","\/\/arxiv.org\/abs\/2202.04235"]
docstr: Create an instance of the :class:`.CompositeAdversarialAttackPyTorch`.
  
  :param classifier: A trained PyTorch classifier.
  :param enabled_attack: Attack pool selection, and attack order designation for fixed order. For simplicity,
                         we use the following abbreviations to specify each attack types. 0: Hue, 1: Saturation,
                         2: Rotation, 3: Brightness, 4: Contrast, 5: PGD(L-infinity). Therefore, `(0,1,2)` means
                         that the attack combines hue, saturation, and rotation; `(0,1,2,3,4)` means the
                         semantic attacks; `(0,1,2,3,4,5)` means the full attacks.
  :param hue_epsilon: The boundary of the hue perturbation. The value is expected to be in the interval
                     `[-np.pi, np.pi]`. Perturbation of `0` means no shift and `-np.pi` and `np.pi` give a
                     complete reversal of the hue channel in the HSV color space in the positive and negative
                     directions, respectively. See `kornia.enhance.adjust_hue` for more details.
  :param sat_epsilon: The boundary of the saturation perturbation. The value is expected to be in the interval
                      `[0, infinity]`. The perturbation of `0` gives a black-and-white image, `1` gives the
                      original image, and `2` enhances the saturation by a factor of 2. See
                      `kornia.geometry.transform.rotate` for more details.
  :param rot_epsilon: The boundary of the rotation perturbation (in degrees). Positive values mean
                      counter-clockwise rotation. See `kornia.geometry.transform.rotate` for more details.
  :param bri_epsilon: The boundary of the brightness perturbation. The value is expected to be in the interval
                     `[-1, 1]`. Perturbation of `0` means no shift, `-1` gives a complete black image, and `1`
                     gives a complete white image. See `kornia.enhance.adjust_brightness` for more details.
  :param con_epsilon: The boundary of the contrast perturbation. The value is expected to be in the interval
                     `[0, infinity]`. Perturbation of `0` gives a complete black image, `1` does not modify the
                     image, and any other value modifies the brightness by this factor. See
                     `kornia.enhance.adjust_contrast` for more details.
  :param pgd_epsilon: The maximum perturbation that the attacker can introduce in the L-infinity ball.
  :param early_stop: When True, the attack will stop if the perturbed example is classified incorrectly by the
                     classifier.
  :param max_iter: The maximum number of iterations for attack order optimization.
  :param max_inner_iter: The maximum number of iterations for each attack optimization.
  :param attack_order: Specify the scheduling type for composite adversarial attack. The value is expected to be
                       `fixed`, `random`, or `scheduled`. `fixed` means the attack order is the same as specified
                       in `enabled_attack`. `random` means the attack order is randomly generated at each
                       iteration. `scheduled` means to enable the attack order optimization proposed in the paper.
                       If only one attack is enabled, `fixed` will be used.
  :param batch_size: The batch size to use during the generation of adversarial samples.
  :param verbose: Show progress bars.
docstr_tok: ["Create","an","instance","of","the",":","class",":","`",".CompositeAdversarialAttackPyTorch","`",".",":","param","classifier",":","A","trained","PyTorch","classifier",".",":","param","enabled_attack",":","Attack","pool","selection",",","and","attack","order","designation","for","fixed","order",".","For","simplicity",",","we","use","the","following","abbreviations","to","specify","each","attack","types",".","0",":","Hue",",","1",":","Saturation",",","2",":","Rotation",",","3",":","Brightness",",","4",":","Contrast",",","5",":","PGD","(","L-infinity",")",".","Therefore",",","`","(","0,1,2",")","`","means","that","the","attack","combines","hue",",","saturation",",","and","rotation",";","`","(","0,1,2,3,4",")","`","means","the","semantic","attacks",";","`","(","0,1,2,3,4,5",")","`","means","the","full","attacks",".",":","param","hue_epsilon",":","The","boundary","of","the","hue","perturbation",".","The","value","is","expected","to","be","in","the","interval","`","[","-np.pi",",","np.pi","]","`",".","Perturbation","of","`","0","`","means","no","shift","and","`","-np.pi","`","and","`","np.pi","`","give","a","complete","reversal","of","the","hue","channel","in","the","HSV","color","space","in","the","positive","and","negative","directions",",","respectively",".","See","`","kornia.enhance.adjust_hue","`","for","more","details",".",":","param","sat_epsilon",":","The","boundary","of","the","saturation","perturbation",".","The","value","is","expected","to","be","in","the","interval","`","[","0",",","infinity","]","`",".","The","perturbation","of","`","0","`","gives","a","black-and-white","image",",","`","1","`","gives","the","original","image",",","and","`","2","`","enhances","the","saturation","by","a","factor","of","2",".","See","`","kornia.geometry.transform.rotate","`","for","more","details",".",":","param","rot_epsilon",":","The","boundary","of","the","rotation","perturbation","(","in","degrees",")",".","Positive","values","mean","counter-clockwise","rotation",".","See","`","kornia.geometry.transform.rotate","`","for","more","details",".",":","param","bri_epsilon",":","The","boundary","of","the","brightness","perturbation",".","The","value","is","expected","to","be","in","the","interval","`","[","-1",",","1","]","`",".","Perturbation","of","`","0","`","means","no","shift",",","`","-1","`","gives","a","complete","black","image",",","and","`","1","`","gives","a","complete","white","image",".","See","`","kornia.enhance.adjust_brightness","`","for","more","details",".",":","param","con_epsilon",":","The","boundary","of","the","contrast","perturbation",".","The","value","is","expected","to","be","in","the","interval","`","[","0",",","infinity","]","`",".","Perturbation","of","`","0","`","gives","a","complete","black","image",",","`","1","`","does","not","modify","the","image",",","and","any","other","value","modifies","the","brightness","by","this","factor",".","See","`","kornia.enhance.adjust_contrast","`","for","more","details",".",":","param","pgd_epsilon",":","The","maximum","perturbation","that","the","attacker","can","introduce","in","the","L-infinity","ball",".",":","param","early_stop",":","When","True",",","the","attack","will","stop","if","the","perturbed","example","is","classified","incorrectly","by","the","classifier",".",":","param","max_iter",":","The","maximum","number","of","iterations","for","attack","order","optimization",".",":","param","max_inner_iter",":","The","maximum","number","of","iterations","for","each","attack","optimization",".",":","param","attack_order",":","Specify","the","scheduling","type","for","composite","adversarial","attack",".","The","value","is","expected","to","be","`","fixed","`",",","`","random","`",",","or","`","scheduled","`",".","`","fixed","`","means","the","attack","order","is","the","same","as","specified","in","`","enabled_attack","`",".","`","random","`","means","the","attack","order","is","randomly","generated","at","each","iteration",".","`","scheduled","`","means","to","enable","the","attack","order","optimization","proposed","in","the","paper",".","If","only","one","attack","is","enabled",",","`","fixed","`","will","be","used",".",":","param","batch_size",":","The","batch","size","to","use","during","the","generation","of","adversarial","samples",".",":","param","verbose",":","Show","progress","bars","."]
code: def __init__(
      self,
      classifier: "PyTorchClassifier",
      enabled_attack: Tuple = (0, 1, 2, 3, 4, 5),
      # Default: Full Attacks; 0: Hue, 1: Saturation, 2: Rotation, 3: Brightness, 4: Contrast, 5: PGD (L-infinity)
      hue_epsilon: Tuple[float, float] = (-np.pi, np.pi),
      sat_epsilon: Tuple[float, float] = (0.7, 1.3),
      rot_epsilon: Tuple[float, float] = (-10.0, 10.0),
      bri_epsilon: Tuple[float, float] = (-0.2, 0.2),
      con_epsilon: Tuple[float, float] = (0.7, 1.3),
      pgd_epsilon: Tuple[float, float] = (
          -8 / 255,
          8 / 255,
      ),  # L-infinity
      early_stop: bool = True,
      max_iter: int = 5,
      max_inner_iter: int = 10,
      attack_order: str = "scheduled",
      batch_size: int = 1,
      verbose: bool = True,
  ) -> None:
      """
      Create an instance of the :class:`.CompositeAdversarialAttackPyTorch`.
  
      :param classifier: A trained PyTorch classifier.
      :param enabled_attack: Attack pool selection, and attack order designation for fixed order. For simplicity,
                             we use the following abbreviations to specify each attack types. 0: Hue, 1: Saturation,
                             2: Rotation, 3: Brightness, 4: Contrast, 5: PGD(L-infinity). Therefore, `(0,1,2)` means
                             that the attack combines hue, saturation, and rotation; `(0,1,2,3,4)` means the
                             semantic attacks; `(0,1,2,3,4,5)` means the full attacks.
      :param hue_epsilon: The boundary of the hue perturbation. The value is expected to be in the interval
                         `[-np.pi, np.pi]`. Perturbation of `0` means no shift and `-np.pi` and `np.pi` give a
                         complete reversal of the hue channel in the HSV color space in the positive and negative
                         directions, respectively. See `kornia.enhance.adjust_hue` for more details.
      :param sat_epsilon: The boundary of the saturation perturbation. The value is expected to be in the interval
                          `[0, infinity]`. The perturbation of `0` gives a black-and-white image, `1` gives the
                          original image, and `2` enhances the saturation by a factor of 2. See
                          `kornia.geometry.transform.rotate` for more details.
      :param rot_epsilon: The boundary of the rotation perturbation (in degrees). Positive values mean
                          counter-clockwise rotation. See `kornia.geometry.transform.rotate` for more details.
      :param bri_epsilon: The boundary of the brightness perturbation. The value is expected to be in the interval
                         `[-1, 1]`. Perturbation of `0` means no shift, `-1` gives a complete black image, and `1`
                         gives a complete white image. See `kornia.enhance.adjust_brightness` for more details.
      :param con_epsilon: The boundary of the contrast perturbation. The value is expected to be in the interval
                         `[0, infinity]`. Perturbation of `0` gives a complete black image, `1` does not modify the
                         image, and any other value modifies the brightness by this factor. See
                         `kornia.enhance.adjust_contrast` for more details.
      :param pgd_epsilon: The maximum perturbation that the attacker can introduce in the L-infinity ball.
      :param early_stop: When True, the attack will stop if the perturbed example is classified incorrectly by the
                         classifier.
      :param max_iter: The maximum number of iterations for attack order optimization.
      :param max_inner_iter: The maximum number of iterations for each attack optimization.
      :param attack_order: Specify the scheduling type for composite adversarial attack. The value is expected to be
                           `fixed`, `random`, or `scheduled`. `fixed` means the attack order is the same as specified
                           in `enabled_attack`. `random` means the attack order is randomly generated at each
                           iteration. `scheduled` means to enable the attack order optimization proposed in the paper.
                           If only one attack is enabled, `fixed` will be used.
      :param batch_size: The batch size to use during the generation of adversarial samples.
      :param verbose: Show progress bars.
      """
      import torch
  
      super().__init__(estimator=classifier)
      self.classifier = classifier
      self.model = classifier.model
      self.device = next(self.model.parameters()).device
      self.fixed_order = enabled_attack
      self.enabled_attack = tuple(sorted(enabled_attack))
      self.epsilons = [
          hue_epsilon,
          sat_epsilon,
          rot_epsilon,
          bri_epsilon,
          con_epsilon,
          pgd_epsilon,
      ]
      self.early_stop = early_stop
      self.attack_order = attack_order
      self.max_iter = (
          max_iter if self.attack_order == "scheduled" else 1
      )
      self.max_inner_iter = max_inner_iter
      self.batch_size = batch_size
      self.verbose = verbose
      self._check_params()
  
      import kornia
  
      self.seq_num = len(self.enabled_attack)  # attack_num
      self.linf_idx = (
          self.enabled_attack.index(5)
          if 5 in self.enabled_attack
          else None
      )
      self.attack_pool = (
          self.caa_hue,
          self.caa_saturation,
          self.caa_rotation,
          self.caa_brightness,
          self.caa_contrast,
          self.caa_linf,
      )
      self.eps_pool = torch.tensor(self.epsilons, device=self.device)
      self.attack_pool_base = (
          kornia.enhance.adjust_hue,
          kornia.enhance.adjust_saturation,
          kornia.geometry.transform.rotate,
          kornia.enhance.adjust_brightness,
          kornia.enhance.adjust_contrast,
      )
      self.attack_dict = tuple(
          self.attack_pool[i] for i in self.enabled_attack
      )
      self.step_size_pool = [
          2.5 * ((eps[1] - eps[0]) / 2) / self.max_inner_iter
          for eps in self.eps_pool
      ]  # 2.5 * ε-test / num_steps
  
      self._description = "Composite Adversarial Attack"
      self._is_scheduling: bool = False
      self.eps_space: List = []
      self.adv_val_space: List = []
      self.curr_dsm: "torch.Tensor" = torch.zeros(
          (len(self.enabled_attack), len(self.enabled_attack))
      )
      self.curr_seq: "torch.Tensor" = torch.zeros(
          len(self.enabled_attack)
      )
      self.is_attacked: "torch.Tensor" = torch.zeros(
          self.batch_size, device=self.device
      ).bool()
      self.is_not_attacked: "torch.Tensor" = torch.ones(
          self.batch_size, device=self.device
      ).bool()
  
imports: from __future__ import absolute_import, division, print_function, unicode_literals
  import logging
  from typing import Optional, Tuple, List, TYPE_CHECKING
  import numpy
  from tqdm.auto import tqdm
  from art.attacks.attack import EvasionAttack
  from art.config import ART_NUMPY_DTYPE
  from art.estimators.estimator import BaseEstimator, LossGradientsMixin
  from art.estimators.classification.classifier import ClassifierMixin
  from art.utils import compute_success, check_and_transform_label_format
label_desc: Use image node_id 1 to create a new CompositeAdversarialAttackPyTorch object from inherited base classes: EvasionAttack with example: obj = CompositeAdversarialAttackPyTorch(classifier, enabled_attack, hue_epsilon, sat_epsilon, rot_epsilon, bri_epsilon, con_epsilon, pgd_epsilon, early_stop, max_iter, max_inner_iter, attack_order, batch_size, verbose)