class_docstr: The black-box zeroth-order optimization attack from Pin-Yu Chen et al. (2018). This attack is a variant of the
  C&W attack which uses ADAM coordinate descent to perform numerical estimation of gradients.
  
  | Paper link: https://arxiv.org/abs/1708.03999
class_docstr_tok: ["The","black-box","zeroth-order","optimization","attack","from","Pin-Yu","Chen","et","al",".","(","2018",")",".","This","attack","is","a","variant","of","the","C","&","W","attack","which","uses","ADAM","coordinate","descent","to","perform","numerical","estimation","of","gradients",".","|","Paper","link",":","https",":","\/\/arxiv.org\/abs\/1708.03999"]
docstr: Create a ZOO attack instance.
  
  :param classifier: A trained classifier.
  :param confidence: Confidence of adversarial examples: a higher value produces examples that are farther
         away, from the original input, but classified with higher confidence as the target class.
  :param targeted: Should the attack target one specific class.
  :param learning_rate: The initial learning rate for the attack algorithm. Smaller values produce better
         results but are slower to converge.
  :param max_iter: The maximum number of iterations.
  :param binary_search_steps: Number of times to adjust constant with binary search (positive value).
  :param initial_const: The initial trade-off constant `c` to use to tune the relative importance of distance
         and confidence. If `binary_search_steps` is large, the initial constant is not important, as discussed in
         Carlini and Wagner (2016).
  :param abort_early: `True` if gradient descent should be abandoned when it gets stuck.
  :param use_resize: `True` if to use the resizing strategy from the paper: first, compute attack on inputs
         resized to 32x32, then increase size if needed to 64x64, followed by 128x128.
  :param use_importance: `True` if to use importance sampling when choosing coordinates to update.
  :param nb_parallel: Number of coordinate updates to run in parallel. A higher value for `nb_parallel` should
         be preferred over a large batch size.
  :param batch_size: Internal size of batches on which adversarial samples are generated. Small batch sizes are
         encouraged for ZOO, as the algorithm already runs `nb_parallel` coordinate updates in parallel for each
         sample. The batch size is a multiplier of `nb_parallel` in terms of memory consumption.
  :param variable_h: Step size for numerical estimation of derivatives.
  :param verbose: Show progress bars.
docstr_tok: ["Create","a","ZOO","attack","instance",".",":","param","classifier",":","A","trained","classifier",".",":","param","confidence",":","Confidence","of","adversarial","examples",":","a","higher","value","produces","examples","that","are","farther","away",",","from","the","original","input",",","but","classified","with","higher","confidence","as","the","target","class",".",":","param","targeted",":","Should","the","attack","target","one","specific","class",".",":","param","learning_rate",":","The","initial","learning","rate","for","the","attack","algorithm",".","Smaller","values","produce","better","results","but","are","slower","to","converge",".",":","param","max_iter",":","The","maximum","number","of","iterations",".",":","param","binary_search_steps",":","Number","of","times","to","adjust","constant","with","binary","search","(","positive","value",")",".",":","param","initial_const",":","The","initial","trade-off","constant","`","c","`","to","use","to","tune","the","relative","importance","of","distance","and","confidence",".","If","`","binary_search_steps","`","is","large",",","the","initial","constant","is","not","important",",","as","discussed","in","Carlini","and","Wagner","(","2016",")",".",":","param","abort_early",":","`","True","`","if","gradient","descent","should","be","abandoned","when","it","gets","stuck",".",":","param","use_resize",":","`","True","`","if","to","use","the","resizing","strategy","from","the","paper",":","first",",","compute","attack","on","inputs","resized","to","32x32",",","then","increase","size","if","needed","to","64x64",",","followed","by","128x128",".",":","param","use_importance",":","`","True","`","if","to","use","importance","sampling","when","choosing","coordinates","to","update",".",":","param","nb_parallel",":","Number","of","coordinate","updates","to","run","in","parallel",".","A","higher","value","for","`","nb_parallel","`","should","be","preferred","over","a","large","batch","size",".",":","param","batch_size",":","Internal","size","of","batches","on","which","adversarial","samples","are","generated",".","Small","batch","sizes","are","encouraged","for","ZOO",",","as","the","algorithm","already","runs","`","nb_parallel","`","coordinate","updates","in","parallel","for","each","sample",".","The","batch","size","is","a","multiplier","of","`","nb_parallel","`","in","terms","of","memory","consumption",".",":","param","variable_h",":","Step","size","for","numerical","estimation","of","derivatives",".",":","param","verbose",":","Show","progress","bars","."]
code: def __init__(
      self,
      classifier: "CLASSIFIER_TYPE",
      confidence: float = 0.0,
      targeted: bool = False,
      learning_rate: float = 1e-2,
      max_iter: int = 10,
      binary_search_steps: int = 1,
      initial_const: float = 1e-3,
      abort_early: bool = True,
      use_resize: bool = True,
      use_importance: bool = True,
      nb_parallel: int = 128,
      batch_size: int = 1,
      variable_h: float = 1e-4,
      verbose: bool = True,
  ):
      """
      Create a ZOO attack instance.
  
      :param classifier: A trained classifier.
      :param confidence: Confidence of adversarial examples: a higher value produces examples that are farther
             away, from the original input, but classified with higher confidence as the target class.
      :param targeted: Should the attack target one specific class.
      :param learning_rate: The initial learning rate for the attack algorithm. Smaller values produce better
             results but are slower to converge.
      :param max_iter: The maximum number of iterations.
      :param binary_search_steps: Number of times to adjust constant with binary search (positive value).
      :param initial_const: The initial trade-off constant `c` to use to tune the relative importance of distance
             and confidence. If `binary_search_steps` is large, the initial constant is not important, as discussed in
             Carlini and Wagner (2016).
      :param abort_early: `True` if gradient descent should be abandoned when it gets stuck.
      :param use_resize: `True` if to use the resizing strategy from the paper: first, compute attack on inputs
             resized to 32x32, then increase size if needed to 64x64, followed by 128x128.
      :param use_importance: `True` if to use importance sampling when choosing coordinates to update.
      :param nb_parallel: Number of coordinate updates to run in parallel. A higher value for `nb_parallel` should
             be preferred over a large batch size.
      :param batch_size: Internal size of batches on which adversarial samples are generated. Small batch sizes are
             encouraged for ZOO, as the algorithm already runs `nb_parallel` coordinate updates in parallel for each
             sample. The batch size is a multiplier of `nb_parallel` in terms of memory consumption.
      :param variable_h: Step size for numerical estimation of derivatives.
      :param verbose: Show progress bars.
      """
      super().__init__(estimator=classifier)
  
      if len(classifier.input_shape) == 1:
          self.input_is_feature_vector = True
          if batch_size != 1:
              raise ValueError(
                  "The current implementation of Zeroth-Order Optimisation attack only supports "
                  "`batch_size=1` with feature vectors as input."
              )
      else:
          self.input_is_feature_vector = False
  
      self.confidence = confidence
      self._targeted = targeted
      self.learning_rate = learning_rate
      self.max_iter = max_iter
      self.binary_search_steps = binary_search_steps
      self.initial_const = initial_const
      self.abort_early = abort_early
      self.use_resize = use_resize
      self.use_importance = use_importance
      self.nb_parallel = nb_parallel
      self.batch_size = batch_size
      self.variable_h = variable_h
      self.verbose = verbose
      self._check_params()
  
      # Initialize some internal variables
      self._init_size = 32
      if self.abort_early:
          self._early_stop_iters = (
              self.max_iter // 10
              if self.max_iter >= 10
              else self.max_iter
          )
  
      # Initialize noise variable to zero
      if self.input_is_feature_vector:
          self.use_resize = False
          self.use_importance = False
          logger.info(  # pragma: no cover
              "Disable resizing and importance sampling because feature vector input has been detected."
          )
  
      if self.use_resize:
          if not self.estimator.channels_first:
              dims = (
                  batch_size,
                  self._init_size,
                  self._init_size,
                  self.estimator.input_shape[-1],
              )
          else:  # pragma: no cover
              dims = (
                  batch_size,
                  self.estimator.input_shape[0],
                  self._init_size,
                  self._init_size,
              )
          self._current_noise = np.zeros(dims, dtype=ART_NUMPY_DTYPE)
      else:
          self._current_noise = np.zeros(
              (batch_size,) + self.estimator.input_shape,
              dtype=ART_NUMPY_DTYPE,
          )
      self._sample_prob = (
          np.ones(self._current_noise.size, dtype=ART_NUMPY_DTYPE)
          / self._current_noise.size
      )
  
      self.adam_mean: Optional[np.ndarray] = None
      self.adam_var: Optional[np.ndarray] = None
      self.adam_epochs: Optional[np.ndarray] = None
  
imports: from __future__ import absolute_import, division, print_function, unicode_literals
  import logging
  from typing import Optional, Tuple, Any, TYPE_CHECKING
  import numpy
  from scipy.ndimage import zoom
  from tqdm.auto import trange
  from art.config import ART_NUMPY_DTYPE
  from art.attacks.attack import EvasionAttack
  from art.estimators.estimator import BaseEstimator
  from art.estimators.classification.classifier import ClassifierMixin
  from art.utils import compute_success, get_labels_np_array, check_and_transform_label_format
label_desc: Use image node_id 1 to create a new ZooAttack object from inherited base classes: EvasionAttack with example: obj = ZooAttack(classifier, confidence, targeted, learning_rate, max_iter, binary_search_steps, initial_const, abort_early, use_resize, use_importance, nb_parallel, batch_size, variable_h, verbose)