class CarliniWagnerL2Attack(Attack, LabelMixin):def __init__(self, predict, num_classes, confidence=0,targeted=False, learning_rate=0.01,binary_search_steps=9, max_iterations=10000,abort_early=True, initial_const=1e-3,clip_min=0., clip_max=1., loss_fn=None):"""Carlini Wagner L2 Attack implementation in pytorchCarlini, Nicholas, and David Wagner. "Towards evaluating therobustness of neural networks." 2017 IEEE Symposium on Security andPrivacy (SP). IEEE, 2017.https://arxiv.org/abs/1608.04644learning_rate: the learning rate for the attack algorithmmax_iterations: the maximum number of iterationsbinary_search_steps: number of binary search times to find the optimumabort_early: if set to true, abort early if getting stuck in local minconfidence: confidence of the adversarial examplestargeted: TODO"""if loss_fn is not None:import warningswarnings.warn("This Attack currently do not support a different loss"" function other than the default. Setting loss_fn manually"" is not effective.")loss_fn = Nonesuper(CarliniWagnerL2Attack, self).__init__(predict, loss_fn, clip_min, clip_max)self.learning_rate = learning_rateself.max_iterations = max_iterationsself.binary_search_steps = binary_search_stepsself.abort_early = abort_earlyself.confidence = confidenceself.initial_const = initial_constself.num_classes = num_classes# The last iteration (if we run many steps) repeat the search once.self.repeat = binary_search_steps >= REPEAT_STEPself.targeted = targeteddef _loss_fn(self, output, y_onehot, l2distsq, const):# TODO: move this out of the class and make this the default loss_fn#   after having targeted tests implementedreal = (y_onehot * output).sum(dim=1)# TODO: make loss modular, write a loss classother = ((1.0 - y_onehot) * output - (y_onehot * TARGET_MULT)).max(1)[0]# - (y_onehot * TARGET_MULT) is for the true label not to be selectedif self.targeted:loss1 = clamp(other - real + self.confidence, min=0.)else:loss1 = clamp(real - other + self.confidence, min=0.)loss2 = (l2distsq).sum()loss1 = torch.sum(const * loss1)loss = loss1 + loss2return lossdef _is_successful(self, output, label, is_logits):# determine success, see if confidence-adjusted logits give the right#   labelif is_logits:output = output.detach().clone()if self.targeted:output[torch.arange(len(label)), label] -= self.confidenceelse:output[torch.arange(len(label)), label] += self.confidencepred = torch.argmax(output, dim=1)else:pred = outputif pred == INVALID_LABEL:return pred.new_zeros(pred.shape).byte()return is_successful(pred, label, self.targeted)def _forward_and_update_delta(self, optimizer, x_atanh, delta, y_onehot, loss_coeffs):optimizer.zero_grad()adv = tanh_rescale(delta + x_atanh, self.clip_min, self.clip_max)transimgs_rescale = tanh_rescale(x_atanh, self.clip_min, self.clip_max)output = self.predict(adv)l2distsq = calc_l2distsq(adv, transimgs_rescale)loss = self._loss_fn(output, y_onehot, l2distsq, loss_coeffs)loss.backward()optimizer.step()return loss.item(), l2distsq.data, output.data, adv.datadef _get_arctanh_x(self, x):result = clamp((x - self.clip_min) / (self.clip_max - self.clip_min),min=self.clip_min, max=self.clip_max) * 2 - 1return torch_arctanh(result * ONE_MINUS_EPS)def _update_if_smaller_dist_succeed(self, adv_img, labs, output, l2distsq, batch_size,cur_l2distsqs, cur_labels,final_l2distsqs, final_labels, final_advs):target_label = labsoutput_logits = output_, output_label = torch.max(output_logits, 1)mask = (l2distsq < cur_l2distsqs) & self._is_successful(output_logits, target_label, True)cur_l2distsqs[mask] = l2distsq[mask]  # redundantcur_labels[mask] = output_label[mask]mask = (l2distsq < final_l2distsqs) & self._is_successful(output_logits, target_label, True)final_l2distsqs[mask] = l2distsq[mask]final_labels[mask] = output_label[mask]final_advs[mask] = adv_img[mask]def _update_loss_coeffs(self, labs, cur_labels, batch_size, loss_coeffs,coeff_upper_bound, coeff_lower_bound):# TODO: remove for loop, not significant, since only called during each# binary search stepfor ii in range(batch_size):cur_labels[ii] = int(cur_labels[ii])if self._is_successful(cur_labels[ii], labs[ii], False):coeff_upper_bound[ii] = min(coeff_upper_bound[ii], loss_coeffs[ii])if coeff_upper_bound[ii] < UPPER_CHECK:loss_coeffs[ii] = (coeff_lower_bound[ii] + coeff_upper_bound[ii]) / 2else:coeff_lower_bound[ii] = max(coeff_lower_bound[ii], loss_coeffs[ii])if coeff_upper_bound[ii] < UPPER_CHECK:loss_coeffs[ii] = (coeff_lower_bound[ii] + coeff_upper_bound[ii]) / 2else:loss_coeffs[ii] *= 10def perturb(self, x, y=None):x, y = self._verify_and_process_inputs(x, y)# Initializationif y is None:y = self._get_predicted_label(x)x = replicate_input(x)batch_size = len(x)coeff_lower_bound = x.new_zeros(batch_size)coeff_upper_bound = x.new_ones(batch_size) * CARLINI_COEFF_UPPERloss_coeffs = torch.ones_like(y).float() * self.initial_constfinal_l2distsqs = [CARLINI_L2DIST_UPPER] * batch_sizefinal_labels = [INVALID_LABEL] * batch_sizefinal_advs = xx_atanh = self._get_arctanh_x(x)y_onehot = to_one_hot(y, self.num_classes).float()final_l2distsqs = torch.FloatTensor(final_l2distsqs).to(x.device)final_labels = torch.LongTensor(final_labels).to(x.device)# Start binary searchfor outer_step in range(self.binary_search_steps):delta = nn.Parameter(torch.zeros_like(x))optimizer = optim.Adam([delta], lr=self.learning_rate)cur_l2distsqs = [CARLINI_L2DIST_UPPER] * batch_sizecur_labels = [INVALID_LABEL] * batch_sizecur_l2distsqs = torch.FloatTensor(cur_l2distsqs).to(x.device)cur_labels = torch.LongTensor(cur_labels).to(x.device)prevloss = PREV_LOSS_INITif (self.repeat and outer_step == (self.binary_search_steps - 1)):loss_coeffs = coeff_upper_boundfor ii in range(self.max_iterations):loss, l2distsq, output, adv_img = \self._forward_and_update_delta(optimizer, x_atanh, delta, y_onehot, loss_coeffs)if self.abort_early:if ii % (self.max_iterations // NUM_CHECKS or 1) == 0:if loss > prevloss * ONE_MINUS_EPS:breakprevloss = lossself._update_if_smaller_dist_succeed(adv_img, y, output, l2distsq, batch_size,cur_l2distsqs, cur_labels,final_l2distsqs, final_labels, final_advs)self._update_loss_coeffs(y, cur_labels, batch_size,loss_coeffs, coeff_upper_bound, coeff_lower_bound)return final_advs