class_docstr: The L_0 distance metric is non-differentiable and therefore is ill-suited for standard gradient descent.
  Instead, we use an iterative algorithm that, in each iteration, identifies some features that don’t have much effect
  on the classifier output and then fixes those features, so their value will never be changed.
  The set of fixed features grows in each iteration until we have, by process of elimination, identified a minimal
  (but possibly not minimum) subset of features that can be modified to generate an adversarial example.
  In each iteration, we use our L_2 attack to identify which features are unimportant [Carlini and Wagner, 2016].
  
  | Paper link: https://arxiv.org/abs/1608.04644
docstr: Create a Carlini&Wagner L_0 attack instance.
  
  :param classifier: A trained classifier.
  :param confidence: Confidence of adversarial examples: a higher value produces examples that are farther away,
                     from the original input, but classified with higher confidence as the target class.
  :param targeted: Should the attack target one specific class.
  :param learning_rate: The initial learning rate for the attack algorithm. Smaller values produce better results
                        but are slower to converge.
  :param binary_search_steps: Number of times to adjust constant with binary search (positive value). If
                              `binary_search_steps` is large, then the algorithm is not very sensitive to the
                              value of `initial_const`. Note that the values gamma=0.999999 and c_upper=10e10 are
                              hardcoded with the same values used by the authors of the method.
  :param max_iter: The maximum number of iterations.
  :param initial_const: The initial trade-off constant `c` to use to tune the relative importance of distance and
                        confidence. If `binary_search_steps` is large, the initial constant is not important, as
                        discussed in Carlini and Wagner (2016).
  :param mask: The initial features that can be modified by the algorithm. If not specified, the
               algorithm uses the full feature set.
  :param warm_start: Instead of starting gradient descent in each iteration from the initial image. we start the
                     gradient descent from the solution found on the previous iteration.
  :param max_halving: Maximum number of halving steps in the line search optimization.
  :param max_doubling: Maximum number of doubling steps in the line search optimization.
  :param batch_size: Size of the batch on which adversarial samples are generated.
  :param verbose: Show progress bars.
docstr_tok: ["Create","a","Carlini","&","Wagner","L_0","attack","instance",".",":","param","classifier",":","A","trained","classifier",".",":","param","confidence",":","Confidence","of","adversarial","examples",":","a","higher","value","produces","examples","that","are","farther","away",",","from","the","original","input",",","but","classified","with","higher","confidence","as","the","target","class",".",":","param","targeted",":","Should","the","attack","target","one","specific","class",".",":","param","learning_rate",":","The","initial","learning","rate","for","the","attack","algorithm",".","Smaller","values","produce","better","results","but","are","slower","to","converge",".",":","param","binary_search_steps",":","Number","of","times","to","adjust","constant","with","binary","search","(","positive","value",")",".","If","`","binary_search_steps","`","is","large",",","then","the","algorithm","is","not","very","sensitive","to","the","value","of","`","initial_const","`",".","Note","that","the","values","gamma=0.999999","and","c_upper=10e10","are","hardcoded","with","the","same","values","used","by","the","authors","of","the","method",".",":","param","max_iter",":","The","maximum","number","of","iterations",".",":","param","initial_const",":","The","initial","trade-off","constant","`","c","`","to","use","to","tune","the","relative","importance","of","distance","and","confidence",".","If","`","binary_search_steps","`","is","large",",","the","initial","constant","is","not","important",",","as","discussed","in","Carlini","and","Wagner","(","2016",")",".",":","param","mask",":","The","initial","features","that","can","be","modified","by","the","algorithm",".","If","not","specified",",","the","algorithm","uses","the","full","feature","set",".",":","param","warm_start",":","Instead","of","starting","gradient","descent","in","each","iteration","from","the","initial","image",".","we","start","the","gradient","descent","from","the","solution","found","on","the","previous","iteration",".",":","param","max_halving",":","Maximum","number","of","halving","steps","in","the","line","search","optimization",".",":","param","max_doubling",":","Maximum","number","of","doubling","steps","in","the","line","search","optimization",".",":","param","batch_size",":","Size","of","the","batch","on","which","adversarial","samples","are","generated",".",":","param","verbose",":","Show","progress","bars","."]
code: def __init__(
      self,
      classifier: "CLASSIFIER_CLASS_LOSS_GRADIENTS_TYPE",
      confidence: float = 0.0,
      targeted: bool = False,
      learning_rate: float = 0.01,
      binary_search_steps: int = 10,
      max_iter: int = 10,
      initial_const: float = 0.01,
      mask: Optional[np.ndarray] = None,
      warm_start: bool = True,
      max_halving: int = 5,
      max_doubling: int = 5,
      batch_size: int = 1,
      verbose: bool = True,
  ):
      """
      Create a Carlini&Wagner L_0 attack instance.
  
      :param classifier: A trained classifier.
      :param confidence: Confidence of adversarial examples: a higher value produces examples that are farther away,
                         from the original input, but classified with higher confidence as the target class.
      :param targeted: Should the attack target one specific class.
      :param learning_rate: The initial learning rate for the attack algorithm. Smaller values produce better results
                            but are slower to converge.
      :param binary_search_steps: Number of times to adjust constant with binary search (positive value). If
                                  `binary_search_steps` is large, then the algorithm is not very sensitive to the
                                  value of `initial_const`. Note that the values gamma=0.999999 and c_upper=10e10 are
                                  hardcoded with the same values used by the authors of the method.
      :param max_iter: The maximum number of iterations.
      :param initial_const: The initial trade-off constant `c` to use to tune the relative importance of distance and
                            confidence. If `binary_search_steps` is large, the initial constant is not important, as
                            discussed in Carlini and Wagner (2016).
      :param mask: The initial features that can be modified by the algorithm. If not specified, the
                   algorithm uses the full feature set.
      :param warm_start: Instead of starting gradient descent in each iteration from the initial image. we start the
                         gradient descent from the solution found on the previous iteration.
      :param max_halving: Maximum number of halving steps in the line search optimization.
      :param max_doubling: Maximum number of doubling steps in the line search optimization.
      :param batch_size: Size of the batch on which adversarial samples are generated.
      :param verbose: Show progress bars.
      """
      super().__init__(
          classifier=classifier,
          confidence=confidence,
          targeted=targeted,
          learning_rate=learning_rate,
          max_iter=max_iter,
          max_halving=max_halving,
          max_doubling=max_doubling,
          batch_size=batch_size,
          verbose=verbose,
      )
  
      self.binary_search_steps = binary_search_steps
      self.initial_const = initial_const
      self.mask = mask
      self.warm_start = warm_start
      self._check_params()
  
      # There are internal hyperparameters:
      # Abort binary search for c if it exceeds this threshold (suggested in Carlini and Wagner (2016)):
      self._c_upper_bound = 10e10
  
      # Smooth arguments of arctanh by multiplying with this constant to avoid division by zero.
      # It appears this is what Carlini and Wagner (2016) are alluding to in their footnote 8. However, it is not
      # clear how their proposed trick ("instead of scaling by 1/2 we scale by 1/2 + eps") works in detail.
      self._tanh_smoother = 0.999999
  
      # The tanh transformation does not always map inputs back to their original values event if they are unmodified
      # To overcome this problem, we set a threshold of minimal difference considered as perturbation
      # Below this threshold, a difference between values is considered as tanh transformation difference.
      self._perturbation_threshold = 1e-06
  
imports: from __future__ import absolute_import, division, print_function, unicode_literals
  import logging
  from typing import Optional, Tuple, TYPE_CHECKING
  import numpy
  from tqdm.auto import trange
  from art.config import ART_NUMPY_DTYPE
  from art.optimizers import Adam
  from art.estimators.estimator import BaseEstimator
  from art.estimators.classification.classifier import ClassGradientsMixin
  from art.attacks.attack import EvasionAttack
  from art.utils import compute_success, get_labels_np_array, tanh_to_original, original_to_tanh
  from art.utils import check_and_transform_label_format
label_desc: Use image node_id 1 to create a new CarliniL0Method object from inherited base classes: CarliniL2Method with example: obj = CarliniL0Method(classifier, confidence, targeted, learning_rate, binary_search_steps, max_iter, initial_const, mask, warm_start, max_halving, max_doubling, batch_size, verbose)