def __call__(self, input_or_adv, label=None, unpack=True,
                 epsilon=1e-5,
                 num_random_targets=0,
                 maxiter=150):

        """Uses L-BFGS-B to minimize the distance between the image and the
        adversarial as well as the cross-entropy between the predictions for
        the adversarial and the the one-hot encoded target class.

        Parameters
        ----------
        input_or_adv : `numpy.ndarray` or :class:`Adversarial`
            The original, unperturbed input as a `numpy.ndarray` or
            an :class:`Adversarial` instance.
        label : int
            The reference label of the original input. Must be passed
            if `a` is a `numpy.ndarray`, must not be passed if `a` is
            an :class:`Adversarial` instance.
        unpack : bool
            If true, returns the adversarial input, otherwise returns
            the Adversarial object.
        epsilon : float
            Epsilon of the binary search.
        num_random_targets : int
            Number of random target classes if no target class is given
            by the criterion.
        maxiter : int
            Maximum number of iterations for L-BFGS-B.

        """

        a = input_or_adv
        del input_or_adv
        del label
        del unpack

        if not self._approximate_gradient and not a.has_gradient():
            return

        original_class = a.original_class

        target_class = a.target_class()
        if target_class is None:
            if num_random_targets == 0 and self._approximate_gradient:
                num_random_targets = 1

            if num_random_targets == 0:
                gradient_attack = GradientAttack()
                gradient_attack(a)
                adv_img = a.image
                if adv_img is None:  # pragma: no coverage
                    # using GradientAttack did not work,
                    # falling back to random target
                    num_random_targets = 1
                    logging.warning('Using GradientAttack to determine a target class failed, falling back to a random target class')  # noqa: E501
                else:
                    logits, _ = a.predictions(adv_img)
                    target_class = np.argmax(logits)
                    target_classes = [target_class]
                    logging.info('Determined a target class using the GradientAttack: {}'.format(target_class))  # noqa: E501

            if num_random_targets > 0:

                # draw num_random_targets random classes all of which are
                # different and not the original class

                num_classes = a.num_classes()
                assert num_random_targets <= num_classes - 1

                # sample one more than necessary
                # remove original class from samples
                # should be more efficient than other approaches, see
                # https://github.com/numpy/numpy/issues/2764
                target_classes = rng.sample(
                    range(num_classes), num_random_targets + 1)
                target_classes = [t for t in target_classes if t != original_class]  # noqa: E501
                target_classes = target_classes[:num_random_targets]

                str_target_classes = [str(t) for t in target_classes]
                logging.info('Random target classes: {}'.format(', '.join(str_target_classes)))  # noqa: E501
        else:
            target_classes = [target_class]

        # avoid mixing GradientAttack and LBFGS Attack
        a._reset()

        for i, target_class in enumerate(target_classes):
            self._optimize(
                a, target_class,
                epsilon=epsilon, maxiter=maxiter)

            if len(target_classes) > 1:  # pragma: no coverage
                logging.info('Best adversarial distance after {} target classes: {}'.format(i + 1, a.distance))
def __call__ ( self , input_or_adv , label = None , unpack = True , epsilon = 1e-5 , num_random_targets = 0 , maxiter = 150 ) : a = input_or_adv del input_or_adv del label del unpack if not self . _approximate_gradient and not a . has_gradient ( ) : return original_class = a . original_class target_class = a . target_class ( ) if target_class is None : if num_random_targets == 0 and self . _approximate_gradient : num_random_targets = 1 if num_random_targets == 0 : gradient_attack = GradientAttack ( ) gradient_attack ( a ) adv_img = a . image if adv_img is None : num_random_targets = 1 logging . warning ( 'Using GradientAttack to determine a target class failed, falling back to a random target class' ) else : logits , _ = a . predictions ( adv_img ) target_class = np . argmax ( logits ) target_classes = [ target_class ] logging . info ( 'Determined a target class using the GradientAttack: {}' . format ( target_class ) ) if num_random_targets > 0 : num_classes = a . num_classes ( ) assert num_random_targets <= num_classes - 1 target_classes = rng . sample ( range ( num_classes ) , num_random_targets + 1 ) target_classes = [ t for t in target_classes if t != original_class ] target_classes = target_classes [ : num_random_targets ] str_target_classes = [ str ( t ) for t in target_classes ] logging . info ( 'Random target classes: {}' . format ( ', ' . join ( str_target_classes ) ) ) else : target_classes = [ target_class ] a . _reset ( ) for i , target_class in enumerate ( target_classes ) : self . _optimize ( a , target_class , epsilon = epsilon , maxiter = maxiter ) if len ( target_classes ) > 1 : logging . info ( 'Best adversarial distance after {} target classes: {}' . format ( i + 1 , a . distance ) )
Uses L-BFGS-B to minimize the distance between the image and the
        adversarial as well as the cross-entropy between the predictions for
        the adversarial and the the one-hot encoded target class.

        Parameters
        ----------
        input_or_adv : `numpy.ndarray` or :class:`Adversarial`
            The original, unperturbed input as a `numpy.ndarray` or
            an :class:`Adversarial` instance.
        label : int
            The reference label of the original input. Must be passed
            if `a` is a `numpy.ndarray`, must not be passed if `a` is
            an :class:`Adversarial` instance.
        unpack : bool
            If true, returns the adversarial input, otherwise returns
            the Adversarial object.
        epsilon : float
            Epsilon of the binary search.
        num_random_targets : int
            Number of random target classes if no target class is given
            by the criterion.
        maxiter : int
            Maximum number of iterations for L-BFGS-B.