class_docstr: Implementation of the hard-label GRAPHITE attack from Feng et al. (2022). This is a physical, black-box attack
  that only requires final class prediction and generates robust physical perturbations that can be applied as
  stickers.
  
  | Paper link: https://arxiv.org/abs/2002.07088
  | Original github link: https://github.com/ryan-feng/GRAPHITE
docstr: Function to generate a heatmap.
  
  :param x: An array with one original input to be attacked.
  :param x_noise: x in the resolution of the noise size.
  :param x_tar_noise: x_tar in the resolution of the noise size.
  :param mask: An array with a mask to be applied to the adversarial perturbations. Shape needs to be
               broadcastable to the shape of x. Any features for which the mask is zero will not be adversarially
               perturbed.
  :param y: The target label.
  :param patches: list of patches from heatmap.
  :param xforms: list of transform params.
  :param clip_min: Minimum value of an example.
  :param clip_max: Maximum value of an example.
  :param pts: Optional. A set of points that will set the crop size in the perspective transform.
  :return: List of transform-robustness scores for the list of patches.
docstr_tok: ["Function","to","generate","a","heatmap",".",":","param","x",":","An","array","with","one","original","input","to","be","attacked",".",":","param","x_noise",":","x","in","the","resolution","of","the","noise","size",".",":","param","x_tar_noise",":","x_tar","in","the","resolution","of","the","noise","size",".",":","param","mask",":","An","array","with","a","mask","to","be","applied","to","the","adversarial","perturbations",".","Shape","needs","to","be","broadcastable","to","the","shape","of","x",".","Any","features","for","which","the","mask","is","zero","will","not","be","adversarially","perturbed",".",":","param","y",":","The","target","label",".",":","param","patches",":","list","of","patches","from","heatmap",".",":","param","xforms",":","list","of","transform","params",".",":","param","clip_min",":","Minimum","value","of","an","example",".",":","param","clip_max",":","Maximum","value","of","an","example",".",":","param","pts",":","Optional",".","A","set","of","points","that","will","set","the","crop","size","in","the","perspective","transform",".",":","return",":","List","of","transform-robustness","scores","for","the","list","of","patches","."]
code: def _get_heatmap(
      self,
      x: np.ndarray,
      x_noise: np.ndarray,
      x_tar_noise: np.ndarray,
      mask: np.ndarray,
      y: int,
      patches: List[np.ndarray],
      xforms: List,
      clip_min: float,
      clip_max: float,
      pts: Optional[np.ndarray] = None,
  ) -> List[float]:
      """
      Function to generate a heatmap.
  
      :param x: An array with one original input to be attacked.
      :param x_noise: x in the resolution of the noise size.
      :param x_tar_noise: x_tar in the resolution of the noise size.
      :param mask: An array with a mask to be applied to the adversarial perturbations. Shape needs to be
                   broadcastable to the shape of x. Any features for which the mask is zero will not be adversarially
                   perturbed.
      :param y: The target label.
      :param patches: list of patches from heatmap.
      :param xforms: list of transform params.
      :param clip_min: Minimum value of an example.
      :param clip_max: Maximum value of an example.
      :param pts: Optional. A set of points that will set the crop size in the perspective transform.
      :return: List of transform-robustness scores for the list of patches.
      """
      tr_scores = []
  
      # iterate over patches and compute transform_robustness without each individual patch
      for patch in patches:
          next_mask = mask * (np.ones(mask.shape) - patch)
          theta = (x_tar_noise - x_noise) * next_mask
          xform_imgs = get_transformed_images(
              x,
              next_mask,
              xforms,
              1.0,
              theta,
              self.net_size,
              clip_min,
              clip_max,
              pts,
          )
          success_rate = run_predictions(
              self.estimator, xform_imgs, y, self.batch_size, False
          )
          tr_scores.append(success_rate)
  
      return tr_scores
  
imports: from __future__ import absolute_import, division, print_function, unicode_literals
  import logging
  from typing import Optional, Tuple, Union, TYPE_CHECKING, List
  import random
  import numpy
  from art.config import ART_NUMPY_DTYPE
  from art.attacks.attack import EvasionAttack
  from art.estimators.estimator import BaseEstimator
  from art.estimators.classification import ClassifierMixin
  from art.utils import compute_success, to_categorical, check_and_transform_label_format
  from art.attacks.evasion.graphite.utils import convert_to_network, get_transform_params, add_noise, get_transformed_images, run_predictions, score_fn
label_desc: Use image node_id 5 for calling the GRAPHITEBlackbox obj's underlying member method code with example usage: obj._get_heatmap(x, x_noise, x_tar_noise, mask, y, patches, xforms, clip_min, clip_max, pts) and returns: tr_scores