code: # MIT License
  #
  # Copyright (C) The Adversarial Robustness Toolbox (ART) Authors 2020
  #
  # Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated
  # documentation files (the "Software"), to deal in the Software without restriction, including without limitation the
  # rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit
  # persons to whom the Software is furnished to do so, subject to the following conditions:
  #
  # The above copyright notice and this permission notice shall be included in all copies or substantial portions of the
  # Software.
  #
  # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
  # WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
  # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
  # TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  # SOFTWARE.
  """
  This module implements the `Auto Projected Gradient Descent` attack.
  
  | Paper link: https://arxiv.org/abs/2003.01690
  """
  import logging
  import math
  from typing import Optional, Union, TYPE_CHECKING
  
  import numpy as np
  from tqdm.auto import trange
  
  from art.config import ART_NUMPY_DTYPE
  from art.attacks.attack import EvasionAttack
  from art.estimators.estimator import BaseEstimator, LossGradientsMixin
  from art.estimators.classification.classifier import ClassifierMixin
  from art.utils import check_and_transform_label_format, projection, random_sphere, is_probability, get_labels_np_array
  
  if TYPE_CHECKING:
      from art.utils import CLASSIFIER_LOSS_GRADIENTS_TYPE
  
  logger = logging.getLogger(__name__)
  
  
  class AutoProjectedGradientDescent(EvasionAttack):
      """
      Implementation of the `Auto Projected Gradient Descent` attack.
  
      | Paper link: https://arxiv.org/abs/2003.01690
      """
  
      attack_params = EvasionAttack.attack_params + [
          "norm",
          "eps",
          "eps_step",
          "max_iter",
          "targeted",
          "nb_random_init",
          "batch_size",
          "loss_type",
          "verbose",
      ]
      _estimator_requirements = (BaseEstimator, LossGradientsMixin, ClassifierMixin)
      _predefined_losses = [None, "cross_entropy", "difference_logits_ratio"]
  
      def __init__(
          self,
          estimator: "CLASSIFIER_LOSS_GRADIENTS_TYPE",
          norm: Union[int, float, str] = np.inf,
          eps: float = 0.3,
          eps_step: float = 0.1,
          max_iter: int = 100,
          targeted: bool = False,
          nb_random_init: int = 5,
          batch_size: int = 32,
          loss_type: Optional[str] = None,
          verbose: bool = True,
      ):
          """
          Create a :class:`.AutoProjectedGradientDescent` instance.
  
          :param estimator: An trained estimator.
          :param norm: The norm of the adversarial perturbation. Possible values: "inf", np.inf, 1 or 2.
          :param eps: Maximum perturbation that the attacker can introduce.
          :param eps_step: Attack step size (input variation) at each iteration.
          :param max_iter: The maximum number of iterations.
          :param targeted: Indicates whether the attack is targeted (True) or untargeted (False).
          :param nb_random_init: Number of random initialisations within the epsilon ball. For num_random_init=0
              starting at the original input.
          :param batch_size: Size of the batch on which adversarial samples are generated.
          :param loss_type: Defines the loss to attack. Available options: None (Use loss defined by estimator),
              "cross_entropy", or "difference_logits_ratio"
          :param verbose: Show progress bars.
          """
          from art.estimators.classification import TensorFlowClassifier, TensorFlowV2Classifier, PyTorchClassifier
  
          if loss_type not in self._predefined_losses:
              raise ValueError(
                  "The argument loss_type has an invalid value. The following options for `loss_type` are currently "
                  "supported: {}".format(self._predefined_losses)
              )
  
          if loss_type is None:
              if hasattr(estimator, "predict") and is_probability(
                  estimator.predict(x=np.ones(shape=(1, *estimator.input_shape), dtype=np.float32))
              ):
                  raise ValueError(  # pragma: no cover
                      "AutoProjectedGradientDescent is expecting logits as estimator output, the provided "
                      "estimator seems to predict probabilities."
                  )
  
              estimator_apgd = estimator
          else:
              if isinstance(estimator, TensorFlowClassifier):
                  import tensorflow as tf
  
                  if loss_type == "cross_entropy":
                      if is_probability(estimator.predict(x=np.ones(shape=(1, *estimator.input_shape)))):
                          raise NotImplementedError("Cross-entropy loss is not implemented for probability output.")
  
                      self._loss_object = tf.reduce_mean(
                          tf.keras.losses.categorical_crossentropy(
                              y_pred=estimator._output, y_true=estimator._labels_ph, from_logits=True
                          )
                      )
  
                  elif loss_type == "difference_logits_ratio":
                      if is_probability(estimator.predict(x=np.ones(shape=(1, *estimator.input_shape)))):
                          raise ValueError(  # pragma: no cover
                              "The provided estimator seems to predict probabilities. "
                              "If loss_type='difference_logits_ratio' the estimator has to to predict logits."
                          )
  
                      raise ValueError(
                          "The loss `difference_logits_ratio` has not been validated completely. It seems that the "
                          "commented implemented below is failing to selected the second largest logit for cases "
                          "where the largest logit is the true logit. For future work `difference_logits_ratio` and "
                          "loss_fn should return the same loss value."
                      )
  
                      # def difference_logits_ratio(y_true, y_pred):
                      #     i_y_true = tf.cast(tf.math.argmax(tf.cast(y_true, tf.int32), axis=1), tf.int32)
                      #     i_y_pred_arg = tf.argsort(y_pred, axis=1)
                      #     # Not completely sure if the following line is correct.
                      #     # `i_y_pred_arg[:, -2], i_y_pred_arg[:, -1]` seems closer to the output of `loss_fn` than
                      #     # `i_y_pred_arg[:, -1], i_y_pred_arg[:, -2]`
                      #     i_z_i = tf.where(i_y_pred_arg[:, -1] != i_y_true[:], i_y_pred_arg[:, -2],
                      #                      i_y_pred_arg[:, -1])
                      #
                      #     z_1 = tf.gather(y_pred, i_y_pred_arg[:, -1], axis=1, batch_dims=0)
                      #     z_3 = tf.gather(y_pred, i_y_pred_arg[:, -3], axis=1, batch_dims=0)
                      #     z_i = tf.gather(y_pred, i_z_i, axis=1, batch_dims=0)
                      #     z_y = tf.gather(y_pred, i_y_true, axis=1, batch_dims=0)
                      #
                      #     z_1 = tf.linalg.diag_part(z_1)
                      #     z_3 = tf.linalg.diag_part(z_3)
                      #     z_i = tf.linalg.diag_part(z_i)
                      #     z_y = tf.linalg.diag_part(z_y)
                      #
                      #     dlr = -(z_y - z_i) / (z_1 - z_3)
                      #
                      #     return tf.reduce_mean(dlr)
                      #
                      # def loss_fn(y_true, y_pred):
                      #     i_y_true = np.argmax(y_true, axis=1)
                      #     i_y_pred_arg = np.argsort(y_pred, axis=1)
                      #     i_z_i = np.where(i_y_pred_arg[:, -1] != i_y_true[:], i_y_pred_arg[:, -1],
                      #                      i_y_pred_arg[:, -2])
                      #
                      #     z_1 = y_pred[:, i_y_pred_arg[:, -1]]
                      #     z_3 = y_pred[:, i_y_pred_arg[:, -3]]
                      #     z_i = y_pred[:, i_z_i]
                      #     z_y = y_pred[:, i_y_true]
                      #
                      #     z_1 = np.diag(z_1)
                      #     z_3 = np.diag(z_3)
                      #     z_i = np.diag(z_i)
                      #     z_y = np.diag(z_y)
                      #
                      #     dlr = -(z_y - z_i) / (z_1 - z_3)
                      #
                      #     return np.mean(dlr)
                      #
                      # self._loss_fn = loss_fn
                      # self._loss_object = difference_logits_ratio(y_true=estimator._labels_ph,
                      #                                             y_pred=estimator._output)
  
                  estimator_apgd = TensorFlowClassifier(
                      input_ph=estimator._input_ph,
                      output=estimator._output,
                      labels_ph=estimator._labels_ph,
                      train=estimator._train,
                      loss=self._loss_object,
                      learning=estimator._learning,
                      sess=estimator._sess,
                      channels_first=estimator.channels_first,
                      clip_values=estimator.clip_values,
                      preprocessing_defences=estimator.preprocessing_defences,
                      postprocessing_defences=estimator.postprocessing_defences,
                      preprocessing=estimator.preprocessing,
                      feed_dict=estimator._feed_dict,
                  )
  
              elif isinstance(estimator, TensorFlowV2Classifier):
                  import tensorflow as tf
  
                  if loss_type == "cross_entropy":
                      if is_probability(estimator.predict(x=np.ones(shape=(1, *estimator.input_shape)))):
                          self._loss_object = tf.keras.losses.CategoricalCrossentropy(from_logits=False)
                      else:
                          self._loss_object = tf.keras.losses.CategoricalCrossentropy(from_logits=True)
                  elif loss_type == "difference_logits_ratio":
                      if is_probability(estimator.predict(x=np.ones(shape=(1, *estimator.input_shape)))):
                          raise ValueError(  # pragma: no cover
                              "The provided estimator seems to predict probabilities. "
                              "If loss_type='difference_logits_ratio' the estimator has to to predict logits."
                          )
  
                      class DifferenceLogitsRatioTensorFlowV2:
                          """
                          Callable class for Difference Logits Ratio loss in TensorFlow v2.
                          """
  
                          def __init__(self):
                              self.reduction = "mean"
  
                          def __call__(self, y_true, y_pred):
                              i_y_true = tf.cast(tf.math.argmax(tf.cast(y_true, tf.int32), axis=1), tf.int32)
                              i_y_pred_arg = tf.argsort(y_pred, axis=1)
                              i_z_i_list = list()
  
                              for i in range(y_true.shape[0]):
                                  if i_y_pred_arg[i, -1] != i_y_true[i]:
                                      i_z_i_list.append(i_y_pred_arg[i, -1])
                                  else:
                                      i_z_i_list.append(i_y_pred_arg[i, -2])
  
                              i_z_i = tf.stack(i_z_i_list)
  
                              z_1 = tf.gather(y_pred, i_y_pred_arg[:, -1], axis=1, batch_dims=0)
                              z_3 = tf.gather(y_pred, i_y_pred_arg[:, -3], axis=1, batch_dims=0)
                              z_i = tf.gather(y_pred, i_z_i, axis=1, batch_dims=0)
                              z_y = tf.gather(y_pred, i_y_true, axis=1, batch_dims=0)
  
                              z_1 = tf.linalg.diag_part(z_1)
                              z_3 = tf.linalg.diag_part(z_3)
                              z_i = tf.linalg.diag_part(z_i)
                              z_y = tf.linalg.diag_part(z_y)
  
                              dlr = -(z_y - z_i) / (z_1 - z_3)
  
                              return tf.reduce_mean(dlr)
  
                      self._loss_fn = DifferenceLogitsRatioTensorFlowV2()
                      self._loss_object = DifferenceLogitsRatioTensorFlowV2()
  
                  estimator_apgd = TensorFlowV2Classifier(
                      model=estimator.model,
                      nb_classes=estimator.nb_classes,
                      input_shape=estimator.input_shape,
                      loss_object=self._loss_object,
                      train_step=estimator._train_step,
                      channels_first=estimator.channels_first,
                      clip_values=estimator.clip_values,
                      preprocessing_defences=estimator.preprocessing_defences,
                      postprocessing_defences=estimator.postprocessing_defences,
                      preprocessing=estimator.preprocessing,
                  )
              elif isinstance(estimator, PyTorchClassifier):
                  import torch
  
                  if loss_type == "cross_entropy":
                      if is_probability(
                          estimator.predict(x=np.ones(shape=(1, *estimator.input_shape), dtype=np.float32))
                      ):
                          raise ValueError(  # pragma: no cover
                              "The provided estimator seems to predict probabilities. If loss_type='cross_entropy' "
                              "the estimator has to to predict logits."
                          )
  
                      self._loss_object = torch.nn.CrossEntropyLoss(reduction="mean")
                  elif loss_type == "difference_logits_ratio":
                      if is_probability(
                          estimator.predict(x=np.ones(shape=(1, *estimator.input_shape), dtype=ART_NUMPY_DTYPE))
                      ):
                          raise ValueError(  # pragma: no cover
                              "The provided estimator seems to predict probabilities. "
                              "If loss_type='difference_logits_ratio' the estimator has to to predict logits."
                          )
  
                      class DifferenceLogitsRatioPyTorch:
                          """
                          Callable class for Difference Logits Ratio loss in PyTorch.
                          """
  
                          def __init__(self):
                              self.reduction = "mean"
  
                          def __call__(self, y_pred, y_true):  # type: ignore
                              if isinstance(y_true, np.ndarray):
                                  y_true = torch.from_numpy(y_true)
                              if isinstance(y_pred, np.ndarray):
                                  y_pred = torch.from_numpy(y_pred)
  
                              y_true = y_true.float()
  
                              i_y_true = torch.argmax(y_true, axis=1)
                              i_y_pred_arg = torch.argsort(y_pred, axis=1)
                              i_z_i_list = list()
  
                              for i in range(y_true.shape[0]):
                                  if i_y_pred_arg[i, -1] != i_y_true[i]:
                                      i_z_i_list.append(i_y_pred_arg[i, -1])
                                  else:
                                      i_z_i_list.append(i_y_pred_arg[i, -2])
  
                              i_z_i = torch.stack(i_z_i_list)
  
                              z_1 = y_pred[:, i_y_pred_arg[:, -1]]
                              z_3 = y_pred[:, i_y_pred_arg[:, -3]]
                              z_i = y_pred[:, i_z_i]
                              z_y = y_pred[:, i_y_true]
  
                              z_1 = torch.diagonal(z_1)
                              z_3 = torch.diagonal(z_3)
                              z_i = torch.diagonal(z_i)
                              z_y = torch.diagonal(z_y)
  
                              dlr = -(z_y - z_i) / (z_1 - z_3)
  
                              return torch.mean(dlr.float())
  
                      self._loss_object = DifferenceLogitsRatioPyTorch()
  
                  estimator_apgd = PyTorchClassifier(
                      model=estimator.model,
                      loss=self._loss_object,
                      input_shape=estimator.input_shape,
                      nb_classes=estimator.nb_classes,
                      optimizer=None,
                      channels_first=estimator.channels_first,
                      clip_values=estimator.clip_values,
                      preprocessing_defences=estimator.preprocessing_defences,
                      postprocessing_defences=estimator.postprocessing_defences,
                      preprocessing=estimator.preprocessing,
                      device_type=str(estimator._device),
                  )
  
              else:  # pragma: no cover
                  raise ValueError("The loss type {} is not supported for the provided estimator.".format(loss_type))
  
          super().__init__(estimator=estimator_apgd)
          self.norm = norm
          self.eps = eps
          self.eps_step = eps_step
          self.max_iter = max_iter
          self.targeted = targeted
          self.nb_random_init = nb_random_init
          self.batch_size = batch_size
          self.loss_type = loss_type
          self.verbose = verbose
          self._check_params()
  
      def generate(self, x: np.ndarray, y: Optional[np.ndarray] = None, **kwargs) -> np.ndarray:
          """
          Generate adversarial samples and return them in an array.
  
          :param x: An array with the original inputs.
          :param y: Target values (class labels) one-hot-encoded of shape `(nb_samples, nb_classes)` or indices of shape
                    (nb_samples,). Only provide this parameter if you'd like to use true labels when crafting adversarial
                    samples. Otherwise, model predictions are used as labels to avoid the "label leaking" effect
                    (explained in this paper: https://arxiv.org/abs/1611.01236). Default is `None`.
          :param mask: An array with a mask broadcastable to input `x` defining where to apply adversarial perturbations.
                       Shape needs to be broadcastable to the shape of x and can also be of the same shape as `x`. Any
                       features for which the mask is zero will not be adversarially perturbed.
          :type mask: `np.ndarray`
          :return: An array holding the adversarial examples.
          """
          mask = kwargs.get("mask")
  
          y = check_and_transform_label_format(y, self.estimator.nb_classes)
  
          if y is None:
              if self.targeted:
                  raise ValueError("Target labels `y` need to be provided for a targeted attack.")
              y = get_labels_np_array(self.estimator.predict(x, batch_size=self.batch_size)).astype(int)
  
          if self.estimator.nb_classes == 2 and y.shape[1] == 1:
              raise ValueError(
                  "This attack has not yet been tested for binary classification with a single output classifier."
              )
  
          x_adv = x.astype(ART_NUMPY_DTYPE)
  
          for _ in trange(max(1, self.nb_random_init), desc="AutoPGD - restart", disable=not self.verbose):
              # Determine correctly predicted samples
              y_pred = self.estimator.predict(x_adv)
              if self.targeted:
                  sample_is_robust = np.argmax(y_pred, axis=1) != np.argmax(y, axis=1)
              elif not self.targeted:
                  sample_is_robust = np.argmax(y_pred, axis=1) == np.argmax(y, axis=1)
  
              if np.sum(sample_is_robust) == 0:
                  break
  
              x_robust = x_adv[sample_is_robust]
              y_robust = y[sample_is_robust]
              x_init = x[sample_is_robust]
  
              n = x_robust.shape[0]
              m = np.prod(x_robust.shape[1:]).item()
              random_perturbation = (
                  random_sphere(n, m, self.eps, self.norm).reshape(x_robust.shape).astype(ART_NUMPY_DTYPE)
              )
  
              x_robust = x_robust + random_perturbation
  
              if self.estimator.clip_values is not None:
                  clip_min, clip_max = self.estimator.clip_values
                  x_robust = np.clip(x_robust, clip_min, clip_max)
  
              perturbation = projection(x_robust - x_init, self.eps, self.norm)
              x_robust = x_init + perturbation
  
              # Compute perturbation with implicit batching
              for batch_id in trange(
                  int(np.ceil(x_robust.shape[0] / float(self.batch_size))),
                  desc="AutoPGD - batch",
                  leave=False,
                  disable=not self.verbose,
              ):
                  self.eta = 2 * self.eps_step
                  batch_index_1, batch_index_2 = batch_id * self.batch_size, (batch_id + 1) * self.batch_size
                  x_k = x_robust[batch_index_1:batch_index_2].astype(ART_NUMPY_DTYPE)
                  x_init_batch = x_init[batch_index_1:batch_index_2].astype(ART_NUMPY_DTYPE)
                  y_batch = y_robust[batch_index_1:batch_index_2]
  
                  p_0 = 0
                  p_1 = 0.22
                  var_w = [p_0, p_1]
  
                  while True:
                      p_j_p_1 = var_w[-1] + max(var_w[-1] - var_w[-2] - 0.03, 0.06)
                      if p_j_p_1 > 1:
                          break
                      var_w.append(p_j_p_1)
  
                  var_w = [math.ceil(p * self.max_iter) for p in var_w]
  
                  eta = self.eps_step
                  self.count_condition_1 = 0
  
                  for k_iter in trange(self.max_iter, desc="AutoPGD - iteration", leave=False, disable=not self.verbose):
  
                      # Get perturbation, use small scalar to avoid division by 0
                      tol = 10e-8
  
                      # Get gradient wrt loss; invert it if attack is targeted
                      grad = self.estimator.loss_gradient(x_k, y_batch) * (1 - 2 * int(self.targeted))
  
                      # Apply norm bound
                      if self.norm in [np.inf, "inf"]:
                          grad = np.sign(grad)
                      elif self.norm == 1:
                          ind = tuple(range(1, len(x_k.shape)))
                          grad = grad / (np.sum(np.abs(grad), axis=ind, keepdims=True) + tol)
                      elif self.norm == 2:
                          ind = tuple(range(1, len(x_k.shape)))
                          grad = grad / (np.sqrt(np.sum(np.square(grad), axis=ind, keepdims=True)) + tol)
                      assert x_k.shape == grad.shape
  
                      perturbation = grad
  
                      if mask is not None:
                          perturbation = perturbation * (mask.astype(ART_NUMPY_DTYPE))
  
                      # Apply perturbation and clip
                      z_k_p_1 = x_k + eta * perturbation
  
                      if self.estimator.clip_values is not None:
                          clip_min, clip_max = self.estimator.clip_values
                          z_k_p_1 = np.clip(z_k_p_1, clip_min, clip_max)
  
                      if k_iter == 0:
                          x_1 = z_k_p_1
                          perturbation = projection(x_1 - x_init_batch, self.eps, self.norm)
                          x_1 = x_init_batch + perturbation
  
                          f_0 = self.estimator.compute_loss(x=x_k, y=y_batch, reduction="mean")
                          f_1 = self.estimator.compute_loss(x=x_1, y=y_batch, reduction="mean")
  
                          self.eta_w_j_m_1 = eta
                          self.f_max_w_j_m_1 = f_0
  
                          if f_1 >= f_0:
                              self.f_max = f_1
                              self.x_max = x_1
                              self.x_max_m_1 = x_init_batch
                              self.count_condition_1 += 1
                          else:
                              self.f_max = f_0
                              self.x_max = x_k.copy()
                              self.x_max_m_1 = x_init_batch
  
                          # Settings for next iteration k
                          x_k_m_1 = x_k.copy()
                          x_k = x_1
  
                      else:
                          perturbation = projection(z_k_p_1 - x_init_batch, self.eps, self.norm)
                          z_k_p_1 = x_init_batch + perturbation
  
                          alpha = 0.75
  
                          x_k_p_1 = x_k + alpha * (z_k_p_1 - x_k) + (1 - alpha) * (x_k - x_k_m_1)
  
                          if self.estimator.clip_values is not None:
                              clip_min, clip_max = self.estimator.clip_values
                              x_k_p_1 = np.clip(x_k_p_1, clip_min, clip_max)
  
                          perturbation = projection(x_k_p_1 - x_init_batch, self.eps, self.norm)
                          x_k_p_1 = x_init_batch + perturbation
  
                          f_k_p_1 = self.estimator.compute_loss(x=x_k_p_1, y=y_batch, reduction="mean")
  
                          if f_k_p_1 == 0.0:
                              x_k = x_k_p_1.copy()
                              break
  
                          if (not self.targeted and f_k_p_1 > self.f_max) or (self.targeted and f_k_p_1 < self.f_max):
                              self.count_condition_1 += 1
                              self.x_max = x_k_p_1
                              self.x_max_m_1 = x_k
                              self.f_max = f_k_p_1
  
                          if k_iter in var_w:
  
                              rho = 0.75
  
                              condition_1 = self.count_condition_1 < rho * (k_iter - var_w[var_w.index(k_iter) - 1])
                              condition_2 = self.eta_w_j_m_1 == eta and self.f_max_w_j_m_1 == self.f_max
  
                              if condition_1 or condition_2:
                                  eta = eta / 2
                                  x_k_m_1 = self.x_max_m_1
                                  x_k = self.x_max
                              else:
                                  x_k_m_1 = x_k
                                  x_k = x_k_p_1.copy()
  
                              self.count_condition_1 = 0
                              self.eta_w_j_m_1 = eta
                              self.f_max_w_j_m_1 = self.f_max
  
                          else:
                              x_k_m_1 = x_k
                              x_k = x_k_p_1.copy()
  
                  y_pred_adv_k = self.estimator.predict(x_k)
                  if self.targeted:
                      sample_is_not_robust_k = np.invert(np.argmax(y_pred_adv_k, axis=1) != np.argmax(y_batch, axis=1))
                  elif not self.targeted:
                      sample_is_not_robust_k = np.invert(np.argmax(y_pred_adv_k, axis=1) == np.argmax(y_batch, axis=1))
  
                  x_robust[batch_index_1:batch_index_2][sample_is_not_robust_k] = x_k[sample_is_not_robust_k]
  
              x_adv[sample_is_robust] = x_robust
  
          return x_adv
  
      def _check_params(self) -> None:
          if self.norm not in [1, 2, np.inf, "inf"]:
              raise ValueError('The argument norm has to be either 1, 2, np.inf, or "inf".')
  
          if not isinstance(self.eps, (int, float)) or self.eps <= 0.0:
              raise ValueError("The argument eps has to be either of type int or float and larger than zero.")
  
          if not isinstance(self.eps_step, (int, float)) or self.eps_step <= 0.0:
              raise ValueError("The argument eps_step has to be either of type int or float and larger than zero.")
  
          if not isinstance(self.max_iter, int) or self.max_iter <= 0:
              raise ValueError("The argument max_iter has to be of type int and larger than zero.")
  
          if not isinstance(self.targeted, bool):
              raise ValueError("The argument targeted has to be of bool.")
  
          if not isinstance(self.nb_random_init, int) or self.nb_random_init <= 0:
              raise ValueError("The argument nb_random_init has to be of type int and larger than zero.")
  
          if not isinstance(self.batch_size, int) or self.batch_size <= 0:
              raise ValueError("The argument batch_size has to be of type int and larger than zero.")
  
          # if self.loss_type not in self._predefined_losses:
          #     raise ValueError("The argument loss_type has to be either {}.".format(self._predefined_losses))
  
          if not isinstance(self.verbose, bool):
              raise ValueError("The argument `verbose` has to be of type bool.")
   # MIT License
  #
  # Copyright (C) The Adversarial Robustness Toolbox (ART) Authors 2018
  #
  # Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated
  # documentation files (the "Software"), to deal in the Software without restriction, including without limitation the
  # rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit
  # persons to whom the Software is furnished to do so, subject to the following conditions:
  #
  # The above copyright notice and this permission notice shall be included in all copies or substantial portions of the
  # Software.
  #
  # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
  # WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
  # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
  # TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  # SOFTWARE.
  from __future__ import absolute_import, division, print_function, unicode_literals
  
  import logging
  import unittest
  
  import numpy as np
  
  from art.defences.preprocessor import FeatureSqueezing
  
  from tests.utils import master_seed
  
  logger = logging.getLogger(__name__)
  
  
  class TestFeatureSqueezing(unittest.TestCase):
      def setUp(self):
          master_seed(seed=1234)
  
      def test_ones(self):
          m, n = 10, 2
          x = np.ones((m, n))
  
          for depth in range(1, 50):
              preproc = FeatureSqueezing(clip_values=(0, 1), bit_depth=depth)
              x_squeezed, _ = preproc(x)
              self.assertTrue((x_squeezed == 1).all())
  
      def test_random(self):
          m, n = 1000, 20
          x = np.random.rand(m, n)
          x_original = x.copy()
          x_zero = np.where(x < 0.5)
          x_one = np.where(x >= 0.5)
  
          preproc = FeatureSqueezing(clip_values=(0, 1), bit_depth=1)
          x_squeezed, _ = preproc(x)
          self.assertTrue((x_squeezed[x_zero] == 0.0).all())
          self.assertTrue((x_squeezed[x_one] == 1.0).all())
  
          preproc = FeatureSqueezing(clip_values=(0, 1), bit_depth=2)
          x_squeezed, _ = preproc(x)
          self.assertFalse(np.logical_and(0.0 < x_squeezed, x_squeezed < 0.33).any())
          self.assertFalse(np.logical_and(0.34 < x_squeezed, x_squeezed < 0.66).any())
          self.assertFalse(np.logical_and(0.67 < x_squeezed, x_squeezed < 1.0).any())
          # Check that x has not been modified by attack and classifier
          self.assertAlmostEqual(float(np.max(np.abs(x_original - x))), 0.0, delta=0.00001)
  
      def test_data_range(self):
          x = np.arange(5)
          preproc = FeatureSqueezing(clip_values=(0, 4), bit_depth=2)
          x_squeezed, _ = preproc(x)
          self.assertTrue(np.array_equal(x, np.arange(5)))
          self.assertTrue(np.allclose(x_squeezed, [0, 1.33, 2.67, 2.67, 4], atol=1e-1))
  
      def test_check_params(self):
          with self.assertRaises(ValueError):
              _ = FeatureSqueezing(clip_values=(0, 4), bit_depth=-1)
  
          with self.assertRaises(ValueError):
              _ = FeatureSqueezing(clip_values=(0, 4, 8))
  
          with self.assertRaises(ValueError):
              _ = FeatureSqueezing(clip_values=(4, 0))
  
  
  if __name__ == "__main__":
      unittest.main()
  
apis: numpy.sum numpy.ones tensorflow.argsort torch.stack torch.argsort torch.diagonal numpy.abs torch.from_numpy tensorflow.stack torch.argmax numpy.argmax tensorflow.cast numpy.prod numpy.square numpy.sign tensorflow.reduce_mean tensorflow.keras.losses.CategoricalCrossentropy torch.nn.CrossEntropyLoss numpy.clip tensorflow.keras.losses.categorical_crossentropy tensorflow.linalg.diag_part tensorflow.gather
apis: numpy.ones numpy.allclose numpy.logical_and numpy.abs numpy.arange numpy.random.rand numpy.where