class_docstr: Implementation of the imperceptible attack against a speech recognition model.
  
  | Paper link: http://proceedings.mlr.press/v97/qin19a.html
docstr: Create adversarial example with small perturbation that successfully deceives the estimator.
  
  The method implements the part of the paper by Qin et al. (2019) that is referred to as the first stage of the
  attack. The authors basically follow Carlini and Wagner (2018).
  
  | Paper link: https://arxiv.org/abs/1801.01944.
  
  :param x: An array with the original inputs to be attacked.
  :param y: Target values of shape (batch_size,). Each sample in `y` is a string and it may possess different
      lengths. A possible example of `y` could be: `y = np.array(['SIXTY ONE', 'HELLO'])`.
  :return: An array with the adversarial outputs.
code: def _create_adversarial(self, x, y) -> np.ndarray:
      """
      Create adversarial example with small perturbation that successfully deceives the estimator.
  
      The method implements the part of the paper by Qin et al. (2019) that is referred to as the first stage of the
      attack. The authors basically follow Carlini and Wagner (2018).
  
      | Paper link: https://arxiv.org/abs/1801.01944.
  
      :param x: An array with the original inputs to be attacked.
      :param y: Target values of shape (batch_size,). Each sample in `y` is a string and it may possess different
          lengths. A possible example of `y` could be: `y = np.array(['SIXTY ONE', 'HELLO'])`.
      :return: An array with the adversarial outputs.
      """
      batch_size = x.shape[0]
  
      # for ragged input, use object dtype
      dtype = np.float32 if x.ndim != 1 else object
  
      epsilon = [self.eps] * batch_size
      x_adversarial = [None] * batch_size
  
      x_perturbed = x.copy()
  
      for i in range(1, self.max_iter_1 + 1):
          # perform FGSM step for x
          gradients = self.estimator.loss_gradient(
              x_perturbed, y, batch_mode=True
          )
          x_perturbed = x_perturbed - self.learning_rate_1 * np.array(
              [np.sign(g) for g in gradients], dtype=dtype
          )
  
          # clip perturbation
          perturbation = x_perturbed - x
          perturbation = np.array(
              [
                  np.clip(p, -e, e)
                  for p, e in zip(perturbation, epsilon)
              ],
              dtype=dtype,
          )
  
          # re-apply clipped perturbation to x
          x_perturbed = x + perturbation
  
          if i % self.num_iter_decrease_eps == 0:
              prediction = self.estimator.predict(
                  x_perturbed, batch_size=batch_size
              )
              for j in range(batch_size):
                  # validate adversarial target, i.e. f(x_perturbed)=y
                  if prediction[j] == y[j].upper():
                      # decrease max norm bound epsilon
                      perturbation_norm = np.max(
                          np.abs(perturbation[j])
                      )
                      if epsilon[j] > perturbation_norm:
                          epsilon[j] = perturbation_norm
                      epsilon[j] *= self.decrease_factor_eps
                      # save current best adversarial example
                      x_adversarial[j] = x_perturbed[j]
              logger.info(
                  "Current iteration %s, epsilon %s", i, epsilon
              )
  
      # return perturbed x if no adversarial example found
      for j in range(batch_size):
          if x_adversarial[j] is None:
              logger.critical(
                  "Adversarial attack stage 1 for x_%s was not successful",
                  j,
              )
              x_adversarial[j] = x_perturbed[j]
  
      return np.array(x_adversarial, dtype=dtype)
  
imports: from __future__ import absolute_import, division, print_function, unicode_literals
  import logging
  from typing import TYPE_CHECKING, Optional, Tuple, Union
  import numpy
  import scipy.signal
  from art.attacks.attack import EvasionAttack
  from art.estimators.estimator import BaseEstimator, LossGradientsMixin, NeuralNetworkMixin
  from art.estimators.pytorch import PyTorchEstimator
  from art.estimators.speech_recognition.speech_recognizer import SpeechRecognizerMixin
  from art.estimators.tensorflow import TensorFlowV2Estimator
  from art.utils import pad_sequence_input
label_desc: Use image node_id 4 for calling the ImperceptibleASR obj's underlying member method code with example usage: obj._create_adversarial(x, y) and returns: np