@call_decorator<EOL><INDENT>def __call__(self, input_or_adv, label=None, unpack=True,<EOL>binary_search_steps=<NUM_LIT:5>, max_iterations=<NUM_LIT:1000>,<EOL>confidence=<NUM_LIT:0>, learning_rate=<NUM_LIT>,<EOL>initial_const=<NUM_LIT>, abort_early=True):<DEDENT>
a = input_or_adv<EOL>del input_or_adv<EOL>del label<EOL>del unpack<EOL>if not a.has_gradient():<EOL><INDENT>logging.fatal('<STR_LIT>'<EOL>'<STR_LIT>')<EOL>return<EOL><DEDENT>min_, max_ = a.bounds()<EOL>def to_attack_space(x):<EOL><INDENT>a = (min_ + max_) / <NUM_LIT:2><EOL>b = (max_ - min_) / <NUM_LIT:2><EOL>x = (x - a) / b<EOL>x = x * <NUM_LIT><EOL>return np.arctanh(x)<EOL><DEDENT>def to_model_space(x):<EOL><INDENT>"""<STR_LIT>"""<EOL>x = np.tanh(x)<EOL>grad = <NUM_LIT:1> - np.square(x)<EOL>a = (min_ + max_) / <NUM_LIT:2><EOL>b = (max_ - min_) / <NUM_LIT:2><EOL>x = x * b + a<EOL>grad = grad * b<EOL>return x, grad<EOL><DEDENT>att_original = to_attack_space(a.original_image)<EOL>reconstructed_original, _ = to_model_space(att_original)<EOL>const = initial_const<EOL>lower_bound = <NUM_LIT:0><EOL>upper_bound = np.inf<EOL>for binary_search_step in range(binary_search_steps):<EOL><INDENT>if binary_search_step == binary_search_steps - <NUM_LIT:1> andbinary_search_steps >= <NUM_LIT:10>:<EOL><INDENT>const = upper_bound<EOL><DEDENT>logging.info('<STR_LIT>'.format(const))<EOL>att_perturbation = np.zeros_like(att_original)<EOL>optimizer = AdamOptimizer(att_perturbation.shape)<EOL>found_adv = False  <EOL>loss_at_previous_check = np.inf<EOL>for iteration in range(max_iterations):<EOL><INDENT>x, dxdp = to_model_space(att_original + att_perturbation)<EOL>logits, is_adv = a.predictions(x)<EOL>loss, dldx = self.loss_function(<EOL>const, a, x, logits, reconstructed_original,<EOL>confidence, min_, max_)<EOL>logging.info('<STR_LIT>'.format(<EOL>loss, a.distance))<EOL>assert dldx.shape == x.shape<EOL>assert dxdp.shape == x.shape<EOL>gradient = dldx * dxdp<EOL>att_perturbation += optimizer(gradient, learning_rate)<EOL>if is_adv:<EOL><INDENT>found_adv = True<EOL><DEDENT>if abort_early anditeration % (np.ceil(max_iterations / <NUM_LIT:10>)) == <NUM_LIT:0>:<EOL><INDENT>if not (loss <= <NUM_LIT> * loss_at_previous_check):<EOL><INDENT>break  <EOL><DEDENT>loss_at_previous_check = loss<EOL><DEDENT><DEDENT>if found_adv:<EOL><INDENT>logging.info('<STR_LIT>'.format(const))<EOL>upper_bound = const<EOL><DEDENT>else:<EOL><INDENT>logging.info('<STR_LIT>'<EOL>'<STR_LIT>'.format(const))<EOL>lower_bound = const<EOL><DEDENT>if upper_bound == np.inf:<EOL><INDENT>const *= <NUM_LIT:10><EOL><DEDENT>else:<EOL><INDENT>const = (lower_bound + upper_bound) / <NUM_LIT:2><EOL><DEDENT><DEDENT>
The L2 version of the Carlini & Wagner attack.

        Parameters
        ----------
        input_or_adv : `numpy.ndarray` or :class:`Adversarial`
            The original, unperturbed input as a `numpy.ndarray` or
            an :class:`Adversarial` instance.
        label : int
            The reference label of the original input. Must be passed
            if `a` is a `numpy.ndarray`, must not be passed if `a` is
            an :class:`Adversarial` instance.
        unpack : bool
            If true, returns the adversarial input, otherwise returns
            the Adversarial object.
        binary_search_steps : int
            The number of steps for the binary search used to
            find the optimal tradeoff-constant between distance and confidence.
        max_iterations : int
            The maximum number of iterations. Larger values are more
            accurate; setting it too small will require a large learning rate
            and will produce poor results.
        confidence : int or float
            Confidence of adversarial examples: a higher value produces
            adversarials that are further away, but more strongly classified
            as adversarial.
        learning_rate : float
            The learning rate for the attack algorithm. Smaller values
            produce better results but take longer to converge.
        initial_const : float
            The initial tradeoff-constant to use to tune the relative
            importance of distance and confidence. If `binary_search_steps`
            is large, the initial constant is not important.
        abort_early : bool
            If True, Adam will be aborted if the loss hasn't decreased
            for some time (a tenth of max_iterations).