class_docstr: Implementation of methods in Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks.
  Wang et al. (2019).
  
  | Paper link: https://people.cs.uchicago.edu/~ravenben/publications/pdf/backdoor-sp19.pdf
docstr: Create a Neural Cleanse classifier.
  
  :param model: Keras model, neural network or other.
  :param use_logits: True if the output of the model are logits; false for probabilities or any other type of
         outputs. Logits output should be favored when possible to ensure attack efficiency.
  :param channels_first: Set channels first or last.
  :param clip_values: Tuple of the form `(min, max)` of floats or `np.ndarray` representing the minimum and
         maximum values allowed for features. If floats are provided, these will be used as the range of all
         features. If arrays are provided, each value will be considered the bound for a feature, thus
         the shape of clip values needs to match the total number of features.
  :param preprocessing_defences: Preprocessing defence(s) to be applied by the classifier.
  :param postprocessing_defences: Postprocessing defence(s) to be applied by the classifier.
  :param preprocessing: Tuple of the form `(subtrahend, divisor)` of floats or `np.ndarray` of values to be
         used for data preprocessing. The first value will be subtracted from the input. The input will then
         be divided by the second one.
  :param input_layer: The index of the layer to consider as input for models with multiple input layers. The layer
                      with this index will be considered for computing gradients. For models with only one input
                      layer this values is not required.
  :param output_layer: Which layer to consider as the output when the models has multiple output layers. The layer
                       with this index will be considered for computing gradients. For models with only one output
                       layer this values is not required.
  :param steps: The maximum number of steps to run the Neural Cleanse optimization
  :param init_cost: The initial value for the cost tensor in the Neural Cleanse optimization
  :param norm: The norm to use for the Neural Cleanse optimization, can be 1, 2, or np.inf
  :param learning_rate: The learning rate for the Neural Cleanse optimization
  :param attack_success_threshold: The threshold at which the generated backdoor is successful enough to stop the
                                   Neural Cleanse optimization
  :param patience: How long to wait for changing the cost multiplier in the Neural Cleanse optimization
  :param early_stop: Whether or not to allow early stopping in the Neural Cleanse optimization
  :param early_stop_threshold: How close values need to come to max value to start counting early stop
  :param early_stop_patience: How long to wait to determine early stopping in the Neural Cleanse optimization
  :param cost_multiplier: How much to change the cost in the Neural Cleanse optimization
  :param batch_size: The batch size for optimizations in the Neural Cleanse optimization
docstr_tok: ["Create","a","Neural","Cleanse","classifier",".",":","param","model",":","Keras","model",",","neural","network","or","other",".",":","param","use_logits",":","True","if","the","output","of","the","model","are","logits",";","false","for","probabilities","or","any","other","type","of","outputs",".","Logits","output","should","be","favored","when","possible","to","ensure","attack","efficiency",".",":","param","channels_first",":","Set","channels","first","or","last",".",":","param","clip_values",":","Tuple","of","the","form","`","(","min",",","max",")","`","of","floats","or","`","np.ndarray","`","representing","the","minimum","and","maximum","values","allowed","for","features",".","If","floats","are","provided",",","these","will","be","used","as","the","range","of","all","features",".","If","arrays","are","provided",",","each","value","will","be","considered","the","bound","for","a","feature",",","thus","the","shape","of","clip","values","needs","to","match","the","total","number","of","features",".",":","param","preprocessing_defences",":","Preprocessing","defence","(","s",")","to","be","applied","by","the","classifier",".",":","param","postprocessing_defences",":","Postprocessing","defence","(","s",")","to","be","applied","by","the","classifier",".",":","param","preprocessing",":","Tuple","of","the","form","`","(","subtrahend",",","divisor",")","`","of","floats","or","`","np.ndarray","`","of","values","to","be","used","for","data","preprocessing",".","The","first","value","will","be","subtracted","from","the","input",".","The","input","will","then","be","divided","by","the","second","one",".",":","param","input_layer",":","The","index","of","the","layer","to","consider","as","input","for","models","with","multiple","input","layers",".","The","layer","with","this","index","will","be","considered","for","computing","gradients",".","For","models","with","only","one","input","layer","this","values","is","not","required",".",":","param","output_layer",":","Which","layer","to","consider","as","the","output","when","the","models","has","multiple","output","layers",".","The","layer","with","this","index","will","be","considered","for","computing","gradients",".","For","models","with","only","one","output","layer","this","values","is","not","required",".",":","param","steps",":","The","maximum","number","of","steps","to","run","the","Neural","Cleanse","optimization",":","param","init_cost",":","The","initial","value","for","the","cost","tensor","in","the","Neural","Cleanse","optimization",":","param","norm",":","The","norm","to","use","for","the","Neural","Cleanse","optimization",",","can","be","1",",","2",",","or","np.inf",":","param","learning_rate",":","The","learning","rate","for","the","Neural","Cleanse","optimization",":","param","attack_success_threshold",":","The","threshold","at","which","the","generated","backdoor","is","successful","enough","to","stop","the","Neural","Cleanse","optimization",":","param","patience",":","How","long","to","wait","for","changing","the","cost","multiplier","in","the","Neural","Cleanse","optimization",":","param","early_stop",":","Whether","or","not","to","allow","early","stopping","in","the","Neural","Cleanse","optimization",":","param","early_stop_threshold",":","How","close","values","need","to","come","to","max","value","to","start","counting","early","stop",":","param","early_stop_patience",":","How","long","to","wait","to","determine","early","stopping","in","the","Neural","Cleanse","optimization",":","param","cost_multiplier",":","How","much","to","change","the","cost","in","the","Neural","Cleanse","optimization",":","param","batch_size",":","The","batch","size","for","optimizations","in","the","Neural","Cleanse","optimization"]
code: def __init__(
      self,
      model: KERAS_MODEL_TYPE,
      use_logits: bool = False,
      channels_first: bool = False,
      clip_values: Optional["CLIP_VALUES_TYPE"] = None,
      preprocessing_defences: Union[
          "Preprocessor", List["Preprocessor"], None
      ] = None,
      postprocessing_defences: Union[
          "Postprocessor", List["Postprocessor"], None
      ] = None,
      preprocessing: "PREPROCESSING_TYPE" = (0.0, 1.0),
      input_layer: int = 0,
      output_layer: int = 0,
      steps: int = 1000,
      init_cost: float = 1e-3,
      norm: Union[int, float] = 2,
      learning_rate: float = 0.1,
      attack_success_threshold: float = 0.99,
      patience: int = 5,
      early_stop: bool = True,
      early_stop_threshold: float = 0.99,
      early_stop_patience: int = 10,
      cost_multiplier: float = 1.5,
      batch_size: int = 32,
  ):
      """
      Create a Neural Cleanse classifier.
  
      :param model: Keras model, neural network or other.
      :param use_logits: True if the output of the model are logits; false for probabilities or any other type of
             outputs. Logits output should be favored when possible to ensure attack efficiency.
      :param channels_first: Set channels first or last.
      :param clip_values: Tuple of the form `(min, max)` of floats or `np.ndarray` representing the minimum and
             maximum values allowed for features. If floats are provided, these will be used as the range of all
             features. If arrays are provided, each value will be considered the bound for a feature, thus
             the shape of clip values needs to match the total number of features.
      :param preprocessing_defences: Preprocessing defence(s) to be applied by the classifier.
      :param postprocessing_defences: Postprocessing defence(s) to be applied by the classifier.
      :param preprocessing: Tuple of the form `(subtrahend, divisor)` of floats or `np.ndarray` of values to be
             used for data preprocessing. The first value will be subtracted from the input. The input will then
             be divided by the second one.
      :param input_layer: The index of the layer to consider as input for models with multiple input layers. The layer
                          with this index will be considered for computing gradients. For models with only one input
                          layer this values is not required.
      :param output_layer: Which layer to consider as the output when the models has multiple output layers. The layer
                           with this index will be considered for computing gradients. For models with only one output
                           layer this values is not required.
      :param steps: The maximum number of steps to run the Neural Cleanse optimization
      :param init_cost: The initial value for the cost tensor in the Neural Cleanse optimization
      :param norm: The norm to use for the Neural Cleanse optimization, can be 1, 2, or np.inf
      :param learning_rate: The learning rate for the Neural Cleanse optimization
      :param attack_success_threshold: The threshold at which the generated backdoor is successful enough to stop the
                                       Neural Cleanse optimization
      :param patience: How long to wait for changing the cost multiplier in the Neural Cleanse optimization
      :param early_stop: Whether or not to allow early stopping in the Neural Cleanse optimization
      :param early_stop_threshold: How close values need to come to max value to start counting early stop
      :param early_stop_patience: How long to wait to determine early stopping in the Neural Cleanse optimization
      :param cost_multiplier: How much to change the cost in the Neural Cleanse optimization
      :param batch_size: The batch size for optimizations in the Neural Cleanse optimization
      """
      import keras.backend as K
      from keras.losses import categorical_crossentropy
      from keras.metrics import categorical_accuracy
  
      super().__init__(
          model=model,
          use_logits=use_logits,
          channels_first=channels_first,
          clip_values=clip_values,
          preprocessing_defences=preprocessing_defences,
          postprocessing_defences=postprocessing_defences,
          preprocessing=preprocessing,
          input_layer=input_layer,
          output_layer=output_layer,
          steps=steps,
          init_cost=init_cost,
          norm=norm,
          learning_rate=learning_rate,
          attack_success_threshold=attack_success_threshold,
          early_stop=early_stop,
          early_stop_threshold=early_stop_threshold,
          early_stop_patience=early_stop_patience,
          patience=patience,
          cost_multiplier=cost_multiplier,
          batch_size=batch_size,
      )
      mask = np.random.uniform(size=super().input_shape)
      pattern = np.random.uniform(size=super().input_shape)
      self.epsilon = K.epsilon()
  
      # Normalize mask between [0, 1]
      self.mask_tensor_raw = K.variable(mask)
      # self.mask_tensor = K.expand_dims(K.tanh(self.mask_tensor_raw) / (2 - self.epsilon) + 0.5, axis=0)
      self.mask_tensor = (
          K.tanh(self.mask_tensor_raw) / (2 - self.epsilon) + 0.5
      )
  
      # Normalize pattern between [0, 1]
      self.pattern_tensor_raw = K.variable(pattern)
      self.pattern_tensor = K.expand_dims(
          K.tanh(self.pattern_tensor_raw) / (2 - self.epsilon) + 0.5,
          axis=0,
      )
  
      reverse_mask_tensor = (
          K.ones_like(self.mask_tensor) - self.mask_tensor
      )
      input_tensor = K.placeholder(model.input_shape)
      x_adv_tensor = (
          reverse_mask_tensor * input_tensor
          + self.mask_tensor * self.pattern_tensor
      )
  
      output_tensor = self.model(x_adv_tensor)
      y_true_tensor = K.placeholder(model.outputs[0].shape.as_list())
  
      self.loss_acc = categorical_accuracy(output_tensor, y_true_tensor)
      self.loss_ce = categorical_crossentropy(
          output_tensor, y_true_tensor
      )
  
      if self.norm == 1:
          # TODO: change 3 to dynamically set img_color
          self.loss_reg = K.sum(K.abs(self.mask_tensor)) / 3
      elif self.norm == 2:
          self.loss_reg = K.sqrt(K.sum(K.square(self.mask_tensor)) / 3)
  
      self.cost = self.init_cost
      self.cost_tensor = K.variable(self.cost)
      self.loss_combined = (
          self.loss_ce + self.loss_reg * self.cost_tensor
      )
  
      try:
          from keras.optimizers.legacy import Adam
  
          self.opt = Adam(lr=self.learning_rate, beta_1=0.5, beta_2=0.9)
      except ImportError:
          from keras.optimizers import adam_v2
  
          self.opt = adam_v2.Adam(
              lr=self.learning_rate, beta_1=0.5, beta_2=0.9
          )
      self.updates = self.opt.get_updates(
          params=[self.pattern_tensor_raw, self.mask_tensor_raw],
          loss=self.loss_combined,
      )
      self.train = K.function(
          [input_tensor, y_true_tensor],
          [
              self.loss_ce,
              self.loss_reg,
              self.loss_combined,
              self.loss_acc,
          ],
          updates=self.updates,
      )
  
imports: from __future__ import absolute_import, division, print_function, unicode_literals
  import logging
  from typing import List, Optional, Tuple, Union, TYPE_CHECKING
  import numpy
  from tqdm.auto import tqdm
  from art.config import ART_NUMPY_DTYPE
  from art.estimators.poison_mitigation.neural_cleanse.neural_cleanse import NeuralCleanseMixin
  from art.estimators.classification.keras import KerasClassifier, KERAS_MODEL_TYPE
label_desc: Use image node_id 1 to create a new KerasNeuralCleanse object from inherited base classes: NeuralCleanseMixin, KerasClassifier with example: obj = KerasNeuralCleanse(model, use_logits, channels_first, clip_values, preprocessing_defences, postprocessing_defences, preprocessing, input_layer, output_layer, steps, init_cost, norm, learning_rate, attack_success_threshold, patience, early_stop, early_stop_threshold, early_stop_patience, cost_multiplier, batch_size)