class_docstr: Class performing adversarial training following Oracle Aligned Adversarial Training (OAAT) protocol.
  
  | Paper link: https://link.springer.com/chapter/10.1007/978-3-031-20065-6_18
class_docstr_tok: ["Class","performing","adversarial","training","following","Oracle","Aligned","Adversarial","Training","(","OAAT",")","protocol",".","|","Paper","link",":","https",":","\/\/link.springer.com\/chapter\/10.1007\/978-3-031-20065-6_18"]
docstr: Compute adversarial examples with cross entropy and lpips distance.
  
  :param x: An array with the original inputs.
  :param y: Target values (class labels) one-hot-encoded of shape `(nb_samples, nb_classes)` or indices of shape
            (nb_samples,). Only provide this parameter if you'd like to use true labels when crafting adversarial
            samples. Otherwise, model predictions are used as labels to avoid the "label leaking" effect
            (explained in this paper: https://arxiv.org/abs/1611.01236).
  :param eps: Maximum perturbation that the attacker can introduce.
  :param eps_step: Attack step size (input variation) at each iteration.
  :param max_iter: number of iterations of attack.
  :param training_mode: training mode of classifier for attack generation. training_mode=False puts classifier in
                          eval mode
  :return: Adversarial examples.
docstr_tok: ["Compute","adversarial","examples","with","cross","entropy","and","lpips","distance",".",":","param","x",":","An","array","with","the","original","inputs",".",":","param","y",":","Target","values","(","class","labels",")","one-hot-encoded","of","shape","`","(","nb_samples",",","nb_classes",")","`","or","indices","of","shape","(","nb_samples",",",")",".","Only","provide","this","parameter","if","you","'d","like","to","use","true","labels","when","crafting","adversarial","samples",".","Otherwise",",","model","predictions","are","used","as","labels","to","avoid","the","``","label","leaking","''","effect","(","explained","in","this","paper",":","https",":","\/\/arxiv.org\/abs\/1611.01236",")",".",":","param","eps",":","Maximum","perturbation","that","the","attacker","can","introduce",".",":","param","eps_step",":","Attack","step","size","(","input","variation",")","at","each","iteration",".",":","param","max_iter",":","number","of","iterations","of","attack",".",":","param","training_mode",":","training","mode","of","classifier","for","attack","generation",".","training_mode=False","puts","classifier","in","eval","mode",":","return",":","Adversarial","examples","."]
code: def _attack_lpips(
      self,
      x: np.ndarray,
      y: np.ndarray,
      eps: Union[int, float, np.ndarray],
      eps_step: Union[int, float, np.ndarray],
      max_iter: int,
      training_mode: bool,
  ) -> np.ndarray:
      """
      Compute adversarial examples with cross entropy and lpips distance.
  
      :param x: An array with the original inputs.
      :param y: Target values (class labels) one-hot-encoded of shape `(nb_samples, nb_classes)` or indices of shape
                (nb_samples,). Only provide this parameter if you'd like to use true labels when crafting adversarial
                samples. Otherwise, model predictions are used as labels to avoid the "label leaking" effect
                (explained in this paper: https://arxiv.org/abs/1611.01236).
      :param eps: Maximum perturbation that the attacker can introduce.
      :param eps_step: Attack step size (input variation) at each iteration.
      :param max_iter: number of iterations of attack.
      :param training_mode: training mode of classifier for attack generation. training_mode=False puts classifier in
                              eval mode
      :return: Adversarial examples.
      """
      import torch
  
      x_t = torch.from_numpy(x.astype(ART_NUMPY_DTYPE)).to(
          self._classifier.device
      )
      y_t = torch.from_numpy(y.astype(ART_NUMPY_DTYPE)).to(
          self._classifier.device
      )
      adv_x = torch.clone(x_t)
  
      for i_max_iter in range(max_iter):
          adv_x = self._one_step_adv_example(
              adv_x,
              x_t,
              y_t,
              eps,
              eps_step,
              i_max_iter == 0,
              training_mode,
          )
  
      return adv_x.cpu().detach().numpy()
  
imports: from __future__ import absolute_import, division, print_function, unicode_literals
  from collections import OrderedDict
  import logging
  import os
  import time
  from typing import Optional, Tuple, TYPE_CHECKING, List, Dict, Union
  import six
  import numpy
  from tqdm.auto import trange
  from art import config
  from art.defences.trainer.adversarial_trainer_oaat import AdversarialTrainerOAAT
  from art.estimators.classification.pytorch import PyTorchClassifier
  from art.data_generators import DataGenerator
  from art.attacks.attack import EvasionAttack
  from art.utils import check_and_transform_label_format, random_sphere
  from art.config import ART_NUMPY_DTYPE
label_desc: Use image node_id 12 for calling the AdversarialTrainerOAATPyTorch obj's underlying member method code with example usage: obj._attack_lpips(x, y, eps, eps_step, max_iter, training_mode) and returns: adv_x