def attack_single_step(self, x, eta, g_feat):
    """
    TensorFlow implementation of the Fast Feature Gradient. This is a
    single step attack similar to Fast Gradient Method that attacks an
    internal representation.

    :param x: the input placeholder
    :param eta: A tensor the same shape as x that holds the perturbation.
    :param g_feat: model's internal tensor for guide
    :return: a tensor for the adversarial example
    """

    adv_x = x + eta
    a_feat = self.model.fprop(adv_x)[self.layer]

    # feat.shape = (batch, c) or (batch, w, h, c)
    axis = list(range(1, len(a_feat.shape)))

    # Compute loss
    # This is a targeted attack, hence the negative sign
    loss = -reduce_sum(tf.square(a_feat - g_feat), axis)

    # Define gradient of loss wrt input
    grad, = tf.gradients(loss, adv_x)

    # Multiply by constant epsilon
    scaled_signed_grad = self.eps_iter * tf.sign(grad)

    # Add perturbation to original example to obtain adversarial example
    adv_x = adv_x + scaled_signed_grad

    # If clipping is needed,
    # reset all values outside of [clip_min, clip_max]
    if (self.clip_min is not None) and (self.clip_max is not None):
      adv_x = tf.clip_by_value(adv_x, self.clip_min, self.clip_max)

    adv_x = tf.stop_gradient(adv_x)

    eta = adv_x - x
    eta = clip_eta(eta, self.ord, self.eps)

    return eta
def attack_single_step ( self , x , eta , g_feat ) : adv_x = x + eta a_feat = self . model . fprop ( adv_x ) [ self . layer ] axis = list ( range ( 1 , len ( a_feat . shape ) ) ) loss = - reduce_sum ( tf . square ( a_feat - g_feat ) , axis ) grad , = tf . gradients ( loss , adv_x ) scaled_signed_grad = self . eps_iter * tf . sign ( grad ) adv_x = adv_x + scaled_signed_grad if ( self . clip_min is not None ) and ( self . clip_max is not None ) : adv_x = tf . clip_by_value ( adv_x , self . clip_min , self . clip_max ) adv_x = tf . stop_gradient ( adv_x ) eta = adv_x - x eta = clip_eta ( eta , self . ord , self . eps ) return eta
TensorFlow implementation of the Fast Feature Gradient. This is a
    single step attack similar to Fast Gradient Method that attacks an
    internal representation.

    :param x: the input placeholder
    :param eta: A tensor the same shape as x that holds the perturbation.
    :param g_feat: model's internal tensor for guide
    :return: a tensor for the adversarial example