### Install AdverTorch from source

Source: https://github.com/borealisai/advertorch/blob/master/docs/user/installation.rst

Clone the repository and install AdverTorch locally by running the setup script.

```bash
python setup.py install
```

--------------------------------

### Install AdverTorch

Source: https://context7.com/borealisai/advertorch/llms.txt

Install AdverTorch using pip or from source. Editable install is useful for development.

```bash
pip install advertorch
# or editable install from source
git clone https://github.com/BorealisAI/advertorch.git
pip install -e advertorch/
```

--------------------------------

### Install AdverTorch using pip

Source: https://github.com/borealisai/advertorch/blob/master/docs/user/installation.rst

Use this command to install the latest version of AdverTorch from PyPI.

```bash
pip install advertorch
```

--------------------------------

### Set up testing environments

Source: https://github.com/borealisai/advertorch/blob/master/docs/user/installation.rst

Install specific versions of TensorFlow, CleverHans, Keras, and Foolbox for testing AdverTorch attacks.

```bash
conda install -c anaconda tensorflow-gpu==1.11.0
```

```bash
pip install git+https://github.com/tensorflow/cleverhans.git@336b9f4ed95dccc7f0d12d338c2038c53786ab70
```

```bash
pip install Keras==2.2.2
```

```bash
pip install foolbox==1.3.2
```

--------------------------------

### Install AdverTorch in editable mode

Source: https://github.com/borealisai/advertorch/blob/master/docs/user/installation.rst

Install AdverTorch in editable mode, which is useful for development.

```bash
pip install -e .
```

--------------------------------

### Generate Adversarial Examples with LinfPGDAttack

Source: https://github.com/borealisai/advertorch/blob/master/README.md

Demonstrates how to use the LinfPGDAttack from AdverTorch to generate adversarial examples. It shows how to create both untargeted and targeted adversarial perturbations for a given PyTorch model and data.

```python
# prepare your pytorch model as "model"
# prepare a batch of data and label as "cln_data" and "true_label"
# ...

from advertorch.attacks import LinfPGDAttack

adversary = LinfPGDAttack(
    model, loss_fn=nn.CrossEntropyLoss(reduction="sum"), eps=0.3,
    nb_iter=40, eps_iter=0.01, rand_init=True, clip_min=0.0, clip_max=1.0,
    targeted=False)

adv_untargeted = adversary.perturb(cln_data, true_label)

target = torch.ones_like(true_label) * 3
adversary.targeted = True
adv_targeted = adversary.perturb(cln_data, target)
```

--------------------------------

### Import Libraries and Setup

Source: https://github.com/borealisai/advertorch/blob/master/advertorch_examples/tutorial_attack_defense_bpda_mnist.ipynb

Imports necessary libraries for visualization, data loading, model definition, and adversarial attack utilities. Sets up the computation device (CPU or GPU).

```python
import matplotlib.pyplot as plt
%matplotlib inline

import os
import argparse
import torch
import torch.nn as nn

from advertorch.utils import predict_from_logits
from advertorch_examples.utils import get_mnist_test_loader
from advertorch_examples.utils import _imshow

torch.manual_seed(0)
use_cuda = torch.cuda.is_available()
device = torch.device("cuda" if use_cuda else "cpu")
```

--------------------------------

### Generate Targeted Adversarial Example

Source: https://github.com/borealisai/advertorch/blob/master/advertorch_examples/tutorial_attack_defense_bpda_mnist.ipynb

Generates a targeted adversarial example. The adversary's 'targeted' attribute is set to True, and a target label (e.g., 3) is provided to guide the perturbation.

```python
target = torch.ones_like(true_label) * 3
adversary.targeted = True
adv_targeted = adversary.perturb(cln_data, target)

```

--------------------------------

### ChooseBestAttack - Ensemble of Attacks

Source: https://context7.com/borealisai/advertorch/llms.txt

Uses ChooseBestAttack to run multiple adversaries and return the most effective adversarial example per input.

```python
from advertorch.attacks import LinfPGDAttack, FGSM, ChooseBestAttack

fgsm = FGSM(model, eps=0.3, clip_min=0.0, clip_max=1.0)
pgd  = LinfPGDAttack(model, eps=0.3, nb_iter=40, eps_iter=0.01, clip_min=0.0, clip_max=1.0)

ensemble = ChooseBestAttack(
    model,
    base_adversaries=[fgsm, pgd],
    targeted=False,
)

# Returns whichever of fgsm/pgd produced the higher-loss adversarial example
adv_best = ensemble.perturb(cln_data, true_label)
```

--------------------------------

### Generate Untargeted Adversarial Example

Source: https://github.com/borealisai/advertorch/blob/master/advertorch_examples/tutorial_attack_defense_bpda_mnist.ipynb

Generates an adversarial example by perturbing the clean data using the configured LinfPGDAttack. This attack aims to cause misclassification without a specific target.

```python
adv_untargeted = adversary.perturb(cln_data, true_label)

```

--------------------------------

### Import necessary libraries and set device

Source: https://github.com/borealisai/advertorch/blob/master/advertorch_examples/tutorial_attack_imagenet.ipynb

Imports PyTorch and sets the device to CUDA if available, otherwise CPU. This is a standard setup for PyTorch operations.

```python
import torch
import torch.nn as nn
device = "cuda" if torch.cuda.is_available() else "cpu"

```

--------------------------------

### Initialize LinfPGDAttack Adversary

Source: https://github.com/borealisai/advertorch/blob/master/advertorch_examples/tutorial_attack_defense_bpda_mnist.ipynb

Constructs an instance of LinfPGDAttack for generating adversarial examples. Configures parameters such as epsilon, number of iterations, step size, and initialization method.

```python
from advertorch.attacks import LinfPGDAttack

adversary = LinfPGDAttack(
    model, loss_fn=nn.CrossEntropyLoss(reduction="sum"), eps=0.15,
    nb_iter=40, eps_iter=0.01, rand_init=True, clip_min=0.0, clip_max=1.0,
    targeted=False)

```

--------------------------------

### ChooseBestAttack

Source: https://context7.com/borealisai/advertorch/llms.txt

Ensemble of attacks that selects the most effective adversarial example per input based on loss increase.

```APIDOC
## ChooseBestAttack — Ensemble of Attacks (Choose Strongest)

Runs multiple adversaries and returns the most effective adversarial example per input, measured by the loss increase.

```python
from advertorch.attacks import LinfPGDAttack, FGSM, ChooseBestAttack

fgsm = FGSM(model, eps=0.3, clip_min=0.0, clip_max=1.0)
pgd  = LinfPGDAttack(model, eps=0.3, nb_iter=40, eps_iter=0.01, clip_min=0.0, clip_max=1.0)

ensemble = ChooseBestAttack(
    model,
    base_adversaries=[fgsm, pgd],
    targeted=False,
)

# Returns whichever of fgsm/pgd produced the higher-loss adversarial example
adv_best = ensemble.perturb(cln_data, true_label)
```
```

--------------------------------

### SpatialTransformAttack Initialization

Source: https://context7.com/borealisai/advertorch/llms.txt

Initializes SpatialTransformAttack for generating adversarial examples via spatial transformations. This attack does not rely on pixel-space perturbations.

```python
from advertorch.attacks import SpatialTransformAttack

adversary = SpatialTransformAttack(
    model,
    num_classes=10,
    clip_min=0.0,
    clip_max=1.0,
    max_iterations=100,
    search_steps=5,
    targeted=False,
)

adv = adversary.perturb(cln_data, true_label)
```

--------------------------------

### Visualize Adversarial Examples

Source: https://github.com/borealisai/advertorch/blob/master/advertorch_examples/tutorial_attack_defense_bpda_mnist.ipynb

Visualizes the original clean images, the untargeted adversarial images, and the targeted adversarial images. Displays the predicted class for each image to show the effect of the attacks.

```python
pred_cln = predict_from_logits(model(cln_data))
pred_untargeted_adv = predict_from_logits(model(adv_untargeted))
pred_targeted_adv = predict_from_logits(model(adv_targeted))

import matplotlib.pyplot as plt
plt.figure(figsize=(10, 8))
for ii in range(batch_size):
    plt.subplot(3, batch_size, ii + 1)
    _imshow(cln_data[ii])
    plt.title("clean \n pred: {}".format(pred_cln[ii]))
    plt.subplot(3, batch_size, ii + 1 + batch_size)
    _imshow(adv_untargeted[ii])
    plt.title("untargeted \n adv \n pred: {}".format(
        pred_untargeted_adv[ii]))
    plt.subplot(3, batch_size, ii + 1 + batch_size * 2)
    _imshow(adv_targeted[ii])
    plt.title("targeted to 3 \n adv \n pred: {}".format(
        pred_targeted_adv[ii]))

plt.tight_layout()
plt.show()
```

--------------------------------

### Basic Iterative Attack (Linf/L2)

Source: https://context7.com/borealisai/advertorch/llms.txt

Multi-step FGSM/FGM variants without random initialization. Useful for generating adversarial examples with controlled perturbation bounds.

```python
from advertorch.attacks import LinfBasicIterativeAttack, L2BasicIterativeAttack

linf_bim = LinfBasicIterativeAttack(
    model,
    eps=0.1,
    nb_iter=10,
    eps_iter=0.05,
    clip_min=0.0,
    clip_max=1.0,
)

l2_bim = L2BasicIterativeAttack(
    model,
    eps=0.1,
    nb_iter=10,
    eps_iter=0.05,
    clip_min=0.0,
    clip_max=1.0,
)

adv_linf = linf_bim.perturb(cln_data, true_label)
adv_l2   = l2_bim.perturb(cln_data, true_label)
```

--------------------------------

### GradientSignAttack (FGSM) - AdverTorch

Source: https://context7.com/borealisai/advertorch/llms.txt

Implements the Fast Gradient Sign Method (FGSM) for generating adversarial examples. Supports both untargeted and targeted attacks. Ensure the model is in eval mode and data is in the range [0, 1].

```python
import torch
import torch.nn as nn
from advertorch.attacks import GradientSignAttack, FGSM

# model: a PyTorch nn.Module in eval mode
# cln_data: [B, C, H, W] float tensor, values in [0, 1]
# true_label: [B] long tensor

adversary = GradientSignAttack(
    model,
    loss_fn=nn.CrossEntropyLoss(reduction="sum"),
    eps=0.3,
    clip_min=0.0,
    clip_max=1.0,
    targeted=False,
)

# Untargeted attack
adv = adversary.perturb(cln_data, true_label)
# adv.shape == cln_data.shape, pixel values clipped to [0, 1]

# Targeted attack: force misclassification as class 3
adversary.targeted = True
target = torch.ones_like(true_label) * 3
adv_targeted = adversary.perturb(cln_data, target)
```

--------------------------------

### GradientSignAttack (FGSM)

Source: https://context7.com/borealisai/advertorch/llms.txt

Implements the Fast Gradient Sign Method (FGSM), a one-step attack that perturbs inputs in the direction of the sign of the loss gradient. It is useful for generating adversarial examples with a specified perturbation budget (eps).

```APIDOC
## GradientSignAttack (FGSM)

### Description
One-step attack that perturbs inputs by `eps` in the direction of the sign of the loss gradient (Goodfellow et al., 2014). Also aliased as `FGSM`.

### Method
`GradientSignAttack` or `FGSM`

### Parameters
- `model`: A PyTorch `nn.Module` in evaluation mode.
- `loss_fn`: The loss function to use (e.g., `nn.CrossEntropyLoss`).
- `eps`: The perturbation budget (float).
- `clip_min`: Minimum value for clipping perturbed inputs (float).
- `clip_max`: Maximum value for clipping perturbed inputs (float).
- `targeted`: Boolean indicating whether to perform a targeted attack.

### Usage
```python
import torch
import torch.nn as nn
from advertorch.attacks import GradientSignAttack, FGSM

# model: a PyTorch nn.Module in eval mode
# cln_data: [B, C, H, W] float tensor, values in [0, 1]
# true_label: [B] long tensor

adversary = GradientSignAttack(
    model,
    loss_fn=nn.CrossEntropyLoss(reduction="sum"),
    eps=0.3,
    clip_min=0.0,
    clip_max=1.0,
    targeted=False,
)

# Untargeted attack
adv = adversary.perturb(cln_data, true_label)
# adv.shape == cln_data.shape, pixel values clipped to [0, 1]

# Targeted attack: force misclassification as class 3
adversary.targeted = True
target = torch.ones_like(true_label) * 3
adv_targeted = adversary.perturb(cln_data, target)
```
```

--------------------------------

### Process Inputs with Defense

Source: https://github.com/borealisai/advertorch/blob/master/advertorch_examples/tutorial_attack_defense_bpda_mnist.ipynb

Apply a defense mechanism to both adversarial and clean data. This is useful for evaluating the effectiveness of a defense against existing adversarial examples.

```python
adv = adv_untargeted
adv_defended = defense(adv)
cln_defended = defense(cln_data)
```

--------------------------------

### GradientAttack (FGM)

Source: https://context7.com/borealisai/advertorch/llms.txt

Implements the Fast Gradient Method (FGM), a one-step attack that uses the normalized gradient to create an L2-bounded perturbation. It is an alternative to FGSM for generating adversarial examples.

```APIDOC
## GradientAttack (FGM)

### Description
One-step attack using the normalized gradient (not gradient sign), giving an L2-bounded perturbation. Also aliased as `FGM`.

### Method
`GradientAttack` or `FGM`

### Parameters
- `model`: A PyTorch `nn.Module` in evaluation mode.
- `loss_fn`: The loss function to use (e.g., `nn.CrossEntropyLoss`).
- `eps`: The perturbation budget (float).
- `clip_min`: Minimum value for clipping perturbed inputs (float).
- `clip_max`: Maximum value for clipping perturbed inputs (float).
- `targeted`: Boolean indicating whether to perform a targeted attack.

### Usage
```python
from advertorch.attacks import GradientAttack, FGM

adversary = GradientAttack(
    model,
    loss_fn=nn.CrossEntropyLoss(reduction="sum"),
    eps=0.5,
    clip_min=0.0,
    clip_max=1.0,
    targeted=False,
)

adv = adversary.perturb(cln_data, true_label)
```
```

--------------------------------

### LinfBasicIterativeAttack / L2BasicIterativeAttack

Source: https://context7.com/borealisai/advertorch/llms.txt

Implements Basic Iterative Attack variants (multi-step FGSM/FGM without random initialization). Useful for generating adversarial examples.

```APIDOC
## LinfBasicIterativeAttack / L2BasicIterativeAttack

### Description
Multi-step variants of FGSM / FGM without random initialization (Kurakin et al., 2016).

### Parameters
- `model`: The neural network model.
- `eps` (float): Maximum perturbation size.
- `nb_iter` (int): Number of iterations.
- `eps_iter` (float): Step size for each iteration.
- `clip_min` (float): Minimum value for clipping.
- `clip_max` (float): Maximum value for clipping.

### Method
`perturb(cln_data, true_label)`

### Request Example
```python
from advertorch.attacks import LinfBasicIterativeAttack, L2BasicIterativeAttack

linf_bim = LinfBasicIterativeAttack(
    model,
    eps=0.1,
    nb_iter=10,
    eps_iter=0.05,
    clip_min=0.0,
    clip_max=1.0,
)

l2_bim = L2BasicIterativeAttack(
    model,
    eps=0.1,
    nb_iter=10,
    eps_iter=0.05,
    clip_min=0.0,
    clip_max=1.0,
)

adv_linf = linf_bim.perturb(cln_data, true_label)
adv_l2   = l2_bim.perturb(cln_data, true_label)
```
```

--------------------------------

### Dataset-Scale Evaluation with attack_whole_dataset

Source: https://context7.com/borealisai/advertorch/llms.txt

Utilities for running an attack adversary across a full DataLoader and collecting prediction statistics. `attack_whole_dataset` collects all adversarial examples, while `multiple_mini_batch_attack` provides mini-batch evaluation with distance tracking.

```python
from advertorch.attacks.utils import attack_whole_dataset, multiple_mini_batch_attack
from torch.utils.data import DataLoader

loader = DataLoader(test_dataset, batch_size=128, shuffle=False)

# Collect all adversarial examples across the dataset
adv_tensor, labels, clean_preds, adv_preds = attack_whole_dataset(
    adversary,
    loader,
    device="cuda",
)
clean_acc = (clean_preds == labels).float().mean().item()
adv_acc   = (adv_preds == labels).float().mean().item()
print(f"Clean accuracy: {clean_acc:.2%}, Robust accuracy: {adv_acc:.2%}")

# Mini-batch evaluation with distance tracking
labels, clean_preds, adv_preds, dists = multiple_mini_batch_attack(
    adversary,
    loader,
    device="cuda",
    norm="Linf",
    num_batch=10,
)
print(f"Mean L∞ distortion: {dists.mean().item():.4f}")
```

--------------------------------

### Composing Defenses with Models

Source: https://context7.com/borealisai/advertorch/llms.txt

Demonstrates how to compose multiple defenses and a model using `nn.Sequential`.

```APIDOC
## Composing Defenses with Models

Defenses are `nn.Module` subclasses and can be composed with any model using `nn.Sequential`.

```python
import torch.nn as nn
from advertorch.defenses import GaussianSmoothing2D, BitSqueezing

# Build a defended model pipeline
defended_model = nn.Sequential(
    BitSqueezing(bit_depth=5),
    GaussianSmoothing2D(sigma=0.5, channels=3),
    model,      # your classifier
)

# Evaluate the defended model on clean and adversarial inputs
with torch.no_grad():
    clean_acc = (defended_model(cln_data).argmax(1) == true_label).float().mean()
    adv_acc   = (defended_model(adv).argmax(1) == true_label).float().mean()
print(f"Clean accuracy:      {clean_acc:.2%}")
print(f"Adversarial accuracy: {adv_acc:.2%}")
```
```

--------------------------------

### SinglePixelAttack and LocalSearchAttack Initialization

Source: https://context7.com/borealisai/advertorch/llms.txt

Initializes SinglePixelAttack for perturbing one pixel at a time and LocalSearchAttack for iterative local neighborhood search. Both are black-box attacks.

```python
from advertorch.attacks import SinglePixelAttack, LocalSearchAttack

# Single pixel: perturb one pixel at a time
spa = SinglePixelAttack(
    model,
    max_pixels=1000,
    clip_min=0.0,
    clip_max=1.0,
    targeted=False,
)
adv_spa = spa.perturb(cln_data, true_label)

# Local search: iterative local neighborhood search
lsa = LocalSearchAttack(
    model,
    clip_min=0.0,
    clip_max=1.0,
    targeted=False,
)
adv_lsa = lsa.perturb(cln_data, true_label)
```

--------------------------------

### SpatialTransformAttack

Source: https://context7.com/borealisai/advertorch/llms.txt

Generates adversarial examples via spatial transformations such as rotations and translations, rather than pixel-space perturbations.

```APIDOC
## SpatialTransformAttack — Spatial Transformation Attack

### Description
Generates adversarial examples via spatial transformations (rotations, translations) rather than pixel-space perturbations (Engstrom et al., 2017).

### Usage
```python
from advertorch.attacks import SpatialTransformAttack

adversary = SpatialTransformAttack(
    model,
    num_classes=10,
    clip_min=0.0,
    clip_max=1.0,
    max_iterations=100,
    search_steps=5,
    targeted=False,
)

adv = adversary.perturb(cln_data, true_label)
```
```

--------------------------------

### Initialize Preprocessing Defenses

Source: https://github.com/borealisai/advertorch/blob/master/advertorch_examples/tutorial_attack_defense_bpda_mnist.ipynb

Initializes several preprocessing-based defenses: MedianSmoothing2D, BitSqueezing, and JPEGFilter. These filters are applied sequentially to the input data to potentially mitigate adversarial attacks.

```python
from advertorch.defenses import MedianSmoothing2D
from advertorch.defenses import BitSqueezing
from advertorch.defenses import JPEGFilter

bits_squeezing = BitSqueezing(bit_depth=5)
median_filter = MedianSmoothing2D(kernel_size=3)
jpeg_filter = JPEGFilter(10)

defense = nn.Sequential(
    jpeg_filter,
    bits_squeezing,
    median_filter,
)

```

--------------------------------

### FABAttack Variants Initialization

Source: https://context7.com/borealisai/advertorch/llms.txt

Initializes LinfFABAttack, L2FABAttack, and L1FABAttack for finding minimal adversarial perturbations in Lp norms. These attacks move toward the decision boundary without gradient sign tricks.

```python
from advertorch.attacks import LinfFABAttack, L2FABAttack, L1FABAttack

linf_fab = LinfFABAttack(
    model,
    n_iter=100,
    eps=0.3,
    alpha_max=0.1,
    targeted=False,
)
adv_linf = linf_fab.perturb(cln_data, true_label)

l2_fab = L2FABAttack(model, n_iter=100, eps=1.0)
adv_l2  = l2_fab.perturb(cln_data, true_label)

l1_fab = L1FABAttack(model, n_iter=100, eps=10.0)
adv_l1  = l1_fab.perturb(cln_data, true_label)
```

--------------------------------

### Attack Class

Source: https://github.com/borealisai/advertorch/blob/master/docs/advertorch/attacks.rst

Base class for all adversarial attacks in Advertorch. Provides a common interface for generating adversarial examples.

```APIDOC
## Attack

### Description
Base class for all adversarial attacks.

### Methods
- `__init__(self, model, norm='inf', eps=8, **kwargs)`: Initializes the attack.
- `forward(self, inputs, targets)`: Computes adversarial examples.

### Parameters
- **model** (torch.nn.Module): The target model to attack.
- **norm** (str): The norm to use for the perturbation (e.g., 'inf', 'l2').
- **eps** (float): The maximum perturbation allowed.
- **kwargs**: Additional keyword arguments.
```

--------------------------------

### Black-Box Gradient Estimator Wrappers

Source: https://context7.com/borealisai/advertorch/llms.txt

Demonstrates importing FDWrapper and NESWrapper to turn white-box attacks into black-box attacks using finite-difference or NES gradient estimates.

```python
from advertorch.attacks import LinfPGDAttack
from advertorch.attacks import FDWrapper, NESWrapper
```

--------------------------------

### LBFGSAttack

Source: https://context7.com/borealisai/advertorch/llms.txt

Implements the L-BFGS Attack, an optimization-based method that uses the L-BFGS optimizer to find minimal perturbations for adversarial examples.

```APIDOC
## LBFGSAttack

### Description
Optimization-based attack using the L-BFGS optimizer to find minimal perturbations (Szegedy et al., 2013).

### Parameters
- `model`: The neural network model.
- `num_classes` (int): Number of classes in the model.
- `batch_size` (int): Batch size for the optimizer.
- `binary_search_steps` (int): Number of steps for binary search.
- `max_iterations` (int): Maximum number of optimization iterations.
- `initial_const` (float): Initial constant for the optimization.
- `clip_min` (float): Minimum value for clipping.
- `clip_max` (float): Maximum value for clipping.
- `targeted` (bool): Whether the attack is targeted.

### Method
`perturb(cln_data, true_label)`

### Request Example
```python
from advertorch.attacks import LBFGSAttack

adversary = LBFGSAttack(
    model,
    num_classes=10,
    batch_size=cln_data.shape[0],
    binary_search_steps=9,
    max_iterations=100,
    initial_const=0.01,
    clip_min=0.0,
    clip_max=1.0,
    targeted=False,
)

adv = adversary.perturb(cln_data, true_label)
```
```

--------------------------------

### FastFeatureAttack

Source: https://context7.com/borealisai/advertorch/llms.txt

Attacks the internal feature representation of a model by minimizing the distance between the perturbed source and a guide image in feature space.

```APIDOC
## FastFeatureAttack — Feature-Space Attack

Attacks the internal feature representation of a model by minimizing the distance between the perturbed source and a guide image in feature space (Sabour et al., 2016).

```python
from advertorch.attacks import FastFeatureAttack

# Requires a model that returns feature embeddings
adversary = FastFeatureAttack(
    feature_model,    # model whose output is a feature vector
    loss_fn=None,     # defaults to nn.MSELoss(reduction="sum")
    eps=0.3,
    eps_iter=0.05,
    nb_iter=10,
    rand_init=True,
    clip_min=0.0,
    clip_max=1.0,
)

# Perturb 'source' so its features match those of 'guide'
adv = adversary.perturb(source, guide)
```
```

--------------------------------

### Load and preprocess image and label

Source: https://github.com/borealisai/advertorch/blob/master/advertorch_examples/tutorial_attack_imagenet.ipynb

Loads a sample image (panda) and its corresponding label for ImageNet. The image is converted to a PyTorch tensor, normalized, and moved to the device. A lookup for class names is also initialized.

```python
from advertorch_examples.utils import ImageNetClassNameLookup
from advertorch_examples.utils import get_panda_image
from advertorch_examples.utils import bhwc2bchw
from advertorch_examples.utils import bchw2bhwc


np_img = get_panda_image()
img = torch.tensor(bhwc2bchw(np_img))[None, :, :, :].float().to(device)
label = torch.tensor([388, ]).long().to(device)
imagenet_label2classname = ImageNetClassNameLookup()

```

--------------------------------

### Composing Defenses with Models

Source: https://context7.com/borealisai/advertorch/llms.txt

Demonstrates composing defenses with models using `nn.Sequential` for a defended model pipeline. Evaluates accuracy on clean and adversarial inputs.

```python
import torch.nn as nn
from advertorch.defenses import GaussianSmoothing2D, BitSqueezing

# Build a defended model pipeline
defended_model = nn.Sequential(
    BitSqueezing(bit_depth=5),
    GaussianSmoothing2D(sigma=0.5, channels=3),
    model,      # your classifier
)

# Evaluate the defended model on clean and adversarial inputs
with torch.no_grad():
    clean_acc = (defended_model(cln_data).argmax(1) == true_label).float().mean()
    adv_acc   = (defended_model(adv).argmax(1) == true_label).float().mean()
print(f"Clean accuracy:      {clean_acc:.2%}")
print(f"Adversarial accuracy: {adv_acc:.2%}")
```

--------------------------------

### ElasticNetL1Attack

Source: https://context7.com/borealisai/advertorch/llms.txt

Implements the Elastic-net attack, which combines L1 and L2 distortion objectives. It's an optimization-based attack for generating adversarial examples.

```APIDOC
## ElasticNetL1Attack

### Description
Elastic-net regularized attack combining L1 and L2 distortion objectives (Chen et al., 2018).

### Parameters
- `model`: The neural network model.
- `num_classes` (int): Number of classes in the model.
- `confidence` (float): Confidence threshold for misclassification.
- `targeted` (bool): Whether the attack is targeted.
- `learning_rate` (float): Learning rate for the optimizer.
- `binary_search_steps` (int): Number of steps for binary search.
- `max_iterations` (int): Maximum number of optimization iterations.
- `clip_min` (float): Minimum value for clipping.
- `clip_max` (float): Maximum value for clipping.

### Method
`perturb(cln_data, true_label)`

### Request Example
```python
from advertorch.attacks import ElasticNetL1Attack

adversary = ElasticNetL1Attack(
    model,
    num_classes=10,
    confidence=0,
    targeted=False,
    learning_rate=1e-2,
    binary_search_steps=9,
    max_iterations=1000,
    clip_min=0.0,
    clip_max=1.0,
)

adv = adversary.perturb(cln_data[:8], true_label[:8])
```
```

--------------------------------

### NESAttack Initialization

Source: https://context7.com/borealisai/advertorch/llms.txt

Initializes NESAttack, an iterative black-box attack using Natural Evolution Strategies to estimate gradients by querying the model with random perturbations.

```python
from advertorch.attacks import NESAttack

adversary = NESAttack(
    model,
    eps=0.05,
    nb_iter=100,
    lr=0.01,
    nb_sample=100,
    fd_eta=0.01,
    clip_min=0.0,
    clip_max=1.0,
)

adv = adversary.perturb(cln_data, true_label)
```

--------------------------------

### NAttack Variants Initialization

Source: https://context7.com/borealisai/advertorch/llms.txt

Initializes LinfNAttack, a black-box score-based attack that models adversarial perturbation distribution as a Gaussian and optimizes it via natural evolution strategies.

```python
from advertorch.attacks import LinfNAttack

adversary = LinfNAttack(
    model,
    eps=0.3,
    nb_iter=300,
    sigma=0.02,
    lr=0.02,
    nb_sample=100,
    clip_min=0.0,
    clip_max=1.0,
    targeted=False,
)

adv = adversary.perturb(cln_data, true_label)
```

--------------------------------

### LinfSPSAAttack Initialization

Source: https://context7.com/borealisai/advertorch/llms.txt

Initializes LinfSPSAAttack, a gradient-free black-box attack using Simultaneous Perturbation Stochastic Approximation. Useful when gradients are unavailable or obfuscated.

```python
from advertorch.attacks import LinfSPSAAttack

adversary = LinfSPSAAttack(
    model,
    eps=0.3,
    delta=0.01,         # SPSA perturbation scale
    lr=0.01,            # Adam learning rate
    nb_iter=10,
    nb_sample=128,      # samples per gradient estimate
    max_batch_size=64,
    targeted=False,
    clip_min=0.0,
    clip_max=1.0,
)

adv = adversary.perturb(cln_data, true_label)
```

--------------------------------

### FastFeatureAttack - Feature-Space Attack

Source: https://context7.com/borealisai/advertorch/llms.txt

Attacks the internal feature representation of a model by minimizing the distance between perturbed source and a guide image in feature space.

```python
from advertorch.attacks import FastFeatureAttack

# Requires a model that returns feature embeddings
adversary = FastFeatureAttack(
    feature_model,    # model whose output is a feature vector
    loss_fn=None,     # defaults to nn.MSELoss(reduction="sum")
    eps=0.3,
    eps_iter=0.05,
    nb_iter=10,
    rand_init=True,
    clip_min=0.0,
    clip_max=1.0,
)

# Perturb 'source' so its features match those of 'guide'
adv = adversary.perturb(source, guide)
```

--------------------------------

### DeepfoolLinfAttack

Source: https://context7.com/borealisai/advertorch/llms.txt

Implements the DeepFool attack, a simple and fast method that iteratively moves inputs across the nearest decision boundary to create adversarial examples.

```APIDOC
## DeepfoolLinfAttack

### Description
Simple, fast attack that iteratively moves inputs across the nearest decision boundary (Moosavi-Dezfooli et al., 2016).

### Parameters
- `model`: The neural network model.
- `num_classes` (int): Number of classes in the model.
- `nb_iter` (int): Maximum number of iterations.
- `eps` (float): Step size for perturbation.
- `overshoot` (float): Parameter to overshoot the boundary.
- `clip_min` (float): Minimum value for clipping.
- `clip_max` (float): Maximum value for clipping.

### Method
`perturb(cln_data, true_label)`

### Request Example
```python
from advertorch.attacks import DeepfoolLinfAttack

adversary = DeepfoolLinfAttack(
    model,
    num_classes=10,
    nb_iter=50,
    eps=0.1,
    overshoot=0.02,
    clip_min=0.0,
    clip_max=1.0,
)

adv = adversary.perturb(cln_data, true_label)
```
```

--------------------------------

### BanditAttack Initialization

Source: https://context7.com/borealisai/advertorch/llms.txt

Initializes BanditAttack, a black-box attack using prior information and bandit-style online learning to improve gradient estimation. Requires iterative querying.

```python
from advertorch.attacks import BanditAttack

adversary = BanditAttack(
    model,
    eps=0.05,
    nb_iter=1000,
    lr=0.01,
    nb_sample=100,
    fd_eta=0.01,
    clip_min=0.0,
    clip_max=1.0,
    targeted=False,
)

adv = adversary.perturb(cln_data, true_label)
```

--------------------------------

### Wrap Model with Gradient Estimators

Source: https://context7.com/borealisai/advertorch/llms.txt

Demonstrates wrapping a model with finite-difference and NES gradient estimators for adversarial attacks.

```python
from advertorch.attacks import LinfPGDAttack
from advertorch.gradient_estimators import FDWrapper, NESWrapper

# Wrap model with finite-difference gradient estimator
fd_model = FDWrapper(model, eta=0.01)
adversary = LinfPGDAttack(
    fd_model,
    eps=0.3,
    nb_iter=40,
    eps_iter=0.01,
    clip_min=0.0,
    clip_max=1.0,
)
adv_fd = adversary.perturb(cln_data, true_label)

# Wrap model with NES gradient estimator
nes_model = NESWrapper(model, sigma=0.01, n_samples=100)
adversary_nes = LinfPGDAttack(nes_model, eps=0.3, nb_iter=20, eps_iter=0.01)
adv_nes = adversary_nes.perturb(cln_data, true_label)
```

--------------------------------

### Apply LinfPGDAttack

Source: https://github.com/borealisai/advertorch/blob/master/advertorch_examples/tutorial_attack_imagenet.ipynb

Instantiates and applies the LinfPGDAttack to generate an adversarial image. The attack parameters (epsilon, step size, number of iterations) are set, and the perturbation is applied to the original image. The results are then visualized.

```python
adversary = LinfPGDAttack(
    model, eps=1./255, eps_iter=1./255*2/40, nb_iter=40,
    rand_init=False, targeted=False)
advimg = adversary.perturb(img, label)
_show_images()

```

--------------------------------

### MomentumIterativeAttack — MI-FGSM

Source: https://context7.com/borealisai/advertorch/llms.txt

MI-FGSM accumulates a velocity vector to stabilize gradient directions, effective for transferable adversarial examples. Set decay_factor for momentum decay.

```python
from advertorch.attacks import LinfMomentumIterativeAttack

adversary = LinfMomentumIterativeAttack(
    model,
    eps=0.3,
    nb_iter=40,
    decay_factor=1.0,   # momentum decay
    eps_iter=0.01,
    clip_min=0.0,
    clip_max=1.0,
    targeted=False,
)

adv = adversary.perturb(cln_data, true_label)
```

--------------------------------

### Load and prepare ImageNet model

Source: https://github.com/borealisai/advertorch/blob/master/advertorch_examples/tutorial_attack_imagenet.ipynb

Loads a pre-trained ResNet101 model from torchvision, applies standard ImageNet normalization, and moves the model to the selected device. The model is set to evaluation mode.

```python
from torchvision.models import resnet101
from advertorch.utils import predict_from_logits
from advertorch.utils import NormalizeByChannelMeanStd

normalize = NormalizeByChannelMeanStd(
    mean=[0.485, 0.456, 0.406], std=[0.229, 0.224, 0.225])
model = resnet101(pretrained=True)
model.eval()
model = nn.Sequential(normalize, model)
model = model.to(device)

```

--------------------------------

### ElasticNetL1Attack — EAD Attack

Source: https://context7.com/borealisai/advertorch/llms.txt

Combines L1 and L2 distortion objectives using Elastic-net regularization. Suitable for finding adversarial examples with a mix of distortion types.

```python
from advertorch.attacks import ElasticNetL1Attack

adversary = ElasticNetL1Attack(
    model,
    num_classes=10,
    confidence=0,
    targeted=False,
    learning_rate=1e-2,
    binary_search_steps=9,
    max_iterations=1000,
    clip_min=0.0,
    clip_max=1.0,
)

adv = adversary.perturb(cln_data[:8], true_label[:8])
```

--------------------------------

### MomentumIterativeAttack / LinfMomentumIterativeAttack / L2MomentumIterativeAttack

Source: https://context7.com/borealisai/advertorch/llms.txt

Implements the Momentum Iterative attack (MI-FGSM), which accumulates a velocity vector to stabilize gradient directions, making it effective for generating transferable adversarial examples.

```APIDOC
## MomentumIterativeAttack / LinfMomentumIterativeAttack / L2MomentumIterativeAttack

### Description
Momentum Iterative attack that accumulates a velocity vector to stabilize gradient directions (Dong et al., 2017). Effective for generating transferable adversarial examples.

### Parameters
- `model`: The neural network model.
- `eps` (float): Maximum perturbation size.
- `nb_iter` (int): Number of iterations.
- `decay_factor` (float): Momentum decay factor.
- `eps_iter` (float): Step size for each iteration.
- `clip_min` (float): Minimum value for clipping.
- `clip_max` (float): Maximum value for clipping.
- `targeted` (bool): Whether the attack is targeted.

### Method
`perturb(cln_data, true_label)`

### Request Example
```python
from advertorch.attacks import LinfMomentumIterativeAttack

adversary = LinfMomentumIterativeAttack(
    model,
    eps=0.3,
    nb_iter=40,
    decay_factor=1.0,
    eps_iter=0.01,
    clip_min=0.0,
    clip_max=1.0,
    targeted=False,
)

adv = adversary.perturb(cln_data, true_label)
```
```

--------------------------------

### Attack Defended Model with BPDA Gradients

Source: https://context7.com/borealisai/advertorch/llms.txt

Demonstrates attacking a defended model using BPDA gradients, with an option for custom substitute forward functions.

```python
adversary = LinfPGDAttack(
    defended_model,
    eps=0.3,
    nb_iter=40,
    eps_iter=0.01,
    clip_min=0.0,
    clip_max=1.0,
)
adv = adversary.perturb(cln_data, true_label)
```

```python
# With custom substitute forward function
gauss_def = GaussianSmoothing2D(sigma=1.0, channels=3)
bpda_custom = BPDAWrapper(
    forward=lambda x: median_def(x),
    forwardsub=lambda x: gauss_def(x),   # Gaussian used for backward pass
)
```

--------------------------------

### LBFGSAttack — L-BFGS Attack

Source: https://context7.com/borealisai/advertorch/llms.txt

Uses the L-BFGS optimizer to find minimal perturbations. Suitable for finding strong adversarial examples but can be computationally intensive. Adjust batch_size and max_iterations.

```python
from advertorch.attacks import LBFGSAttack

adversary = LBFGSAttack(
    model,
    num_classes=10,
    batch_size=cln_data.shape[0],
    binary_search_steps=9,
    max_iterations=100,
    initial_const=0.01,
    clip_min=0.0,
    clip_max=1.0,
    targeted=False,
)

adv = adversary.perturb(cln_data, true_label)
```

--------------------------------

### GenAttack Variants Initialization

Source: https://context7.com/borealisai/advertorch/llms.txt

Initializes LinfGenAttack and L2GenAttack, which are population-based black-box attacks using a genetic algorithm. They evolve adversarial perturbations without gradient queries.

```python
from advertorch.attacks import LinfGenAttack, L2GenAttack

adversary = LinfGenAttack(
    model,
    eps=0.3,
    nb_iter=100,
    population=10,
    mutation_rate=0.005,
    clip_min=0.0,
    clip_max=1.0,
    targeted=False,
)

adv = adversary.perturb(cln_data, true_label)
```

--------------------------------

### Apply SparseL1DescentAttack

Source: https://github.com/borealisai/advertorch/blob/master/advertorch_examples/tutorial_attack_imagenet.ipynb

Instantiates and applies the SparseL1DescentAttack. This attack aims to find sparse perturbations. The attack parameters, including a large epsilon and step size, are set, and the resulting adversarial image is visualized with a different enhancement factor.

```python
adversary = SparseL1DescentAttack(
    model, eps=1000., eps_iter=2*1000./40, nb_iter=40,
    rand_init=False, targeted=False)
advimg = adversary.perturb(img, label)
_show_images(50)

```

--------------------------------

### GradientSignAttack Class

Source: https://github.com/borealisai/advertorch/blob/master/docs/advertorch/attacks.rst

Implements the Fast Gradient Sign Method (FGSM).

```APIDOC
## GradientSignAttack

### Description
Implements the Fast Gradient Sign Method (FGSM) attack.

### Methods
- `__init__(self, model, norm='inf', eps=8, **kwargs)`: Initializes the FGSM attack.
- `forward(self, inputs, targets)`: Computes adversarial examples using FGSM.

### Parameters
- **model** (torch.nn.Module): The target model to attack.
- **norm** (str): The norm to use for the perturbation.
- **eps** (float): The maximum perturbation allowed.
- **kwargs**: Additional keyword arguments.
```

--------------------------------

### Load Pre-trained MNIST Model

Source: https://github.com/borealisai/advertorch/blob/master/advertorch_examples/tutorial_attack_defense_bpda_mnist.ipynb

Loads a pre-trained LeNet5 model for MNIST classification. Ensure the trained model file ('mnist_lenet5_clntrained.pt') is available in the specified path.

```python
from advertorch.test_utils import LeNet5
from advertorch_examples.utils import TRAINED_MODEL_PATH

filename = "mnist_lenet5_clntrained.pt"
# filename = "mnist_lenet5_advtrained.pt"

model = LeNet5()
model.load_state_dict(
    torch.load(os.path.join(TRAINED_MODEL_PATH, filename)))
model.to(device)
model.eval()
```

--------------------------------

### Apply L2PGDAttack

Source: https://github.com/borealisai/advertorch/blob/master/advertorch_examples/tutorial_attack_imagenet.ipynb

Instantiates and applies the L2PGDAttack to generate an adversarial image. This attack uses the L2 norm for perturbation constraints. The attack parameters are configured, and the perturbed image is visualized.

```python
adversary = L2PGDAttack(
    model, eps=1., eps_iter=1.*2/40, nb_iter=40,
    
    rand_init=False, targeted=False)
advimg = adversary.perturb(img, label)
_show_images()

```

--------------------------------

### NormalizeByChannelMeanStd Input Normalization Module

Source: https://context7.com/borealisai/advertorch/llms.txt

Differentiable normalization layer for prepending dataset-specific mean/std normalization to a model. Enables attacks on the raw pixel space while the model sees normalized inputs.

```python
from advertorch.utils import NormalizeByChannelMeanStd, CIFAR10_MEAN, CIFAR10_STD
import torch.nn as nn

normalizer = NormalizeByChannelMeanStd(
    mean=CIFAR10_MEAN,    # (0.4914, 0.4822, 0.4465)
    std=CIFAR10_STD,      # (0.2023, 0.1994, 0.2010)
)

# Prepend normalizer so the model accepts raw [0,1] inputs
normalized_model = nn.Sequential(normalizer, model)

# Attacks now operate directly on [0, 1] pixel values
adversary = LinfPGDAttack(normalized_model, eps=8/255, nb_iter=20, eps_iter=2/255)
adv = adversary.perturb(cln_data, true_label)
```

--------------------------------

### FABAttack / LinfFABAttack / L2FABAttack / L1FABAttack

Source: https://context7.com/borealisai/advertorch/llms.txt

Implements the Fast Adaptive Boundary Attack, which finds minimal adversarial perturbations in Lp norms by moving toward the decision boundary without gradient sign tricks.

```APIDOC
## FABAttack / LinfFABAttack / L2FABAttack / L1FABAttack — Fast Adaptive Boundary Attack

### Description
Finds minimal adversarial perturbations in Lp norms by moving toward the decision boundary without gradient sign tricks (Croce & Hein, 2020).

### Usage
```python
from advertorch.attacks import LinfFABAttack, L2FABAttack, L1FABAttack

linf_fab = LinfFABAttack(
    model,
    n_iter=100,
    eps=0.3,
    alpha_max=0.1,
    targeted=False,
)
adv_linf = linf_fab.perturb(cln_data, true_label)

l2_fab = L2FABAttack(model, n_iter=100, eps=1.0)
adv_l2  = l2_fab.perturb(cln_data, true_label)

l1_fab = L1FABAttack(model, n_iter=100, eps=10.0)
adv_l1  = l1_fab.perturb(cln_data, true_label)
```
```

--------------------------------

### Visualize Clean and Defended Data

Source: https://github.com/borealisai/advertorch/blob/master/advertorch_examples/tutorial_attack_defense_bpda_mnist.ipynb

Visualize the original clean data, the defended clean data, the adversarial data, and the defended adversarial data. This helps in visually assessing the impact of the defense and the attack.

```python
pred_cln = predict_from_logits(model(cln_data))
pred_cln_defended = predict_from_logits(model(cln_defended))
pred_adv = predict_from_logits(model(adv))
pred_adv_defended = predict_from_logits(model(adv_defended))


import matplotlib.pyplot as plt
plt.figure(figsize=(10, 10))
for ii in range(batch_size):
    plt.subplot(4, batch_size, ii + 1)
    _imshow(cln_data[ii])
    plt.title("clean \n pred: {}".format(pred_cln[ii]))
    plt.subplot(4, batch_size, ii + 1 + batch_size)
    _imshow(cln_data[ii])
    plt.title("defended clean \n pred: {}".format(pred_cln_defended[ii]))
    plt.subplot(4, batch_size, ii + 1 + batch_size * 2)
    _imshow(adv[ii])
    plt.title("adv \n pred: {}".format(
        pred_adv[ii]))
    plt.subplot(4, batch_size, ii + 1 + batch_size * 3)
    _imshow(adv_defended[ii])
    plt.title("defended adv \n pred: {}".format(
        pred_adv_defended[ii]))

plt.tight_layout()
plt.show()
```