### Install AdverTorch from source

Source: https://advertorch.readthedocs.io/en/latest/user/installation.html

Clone the AdverTorch repository and run this command to install it from the source code.

```bash
python setup.py install
```

--------------------------------

### Install AdverTorch using pip

Source: https://advertorch.readthedocs.io/en/latest/user/installation.html

Use this command to install the latest stable version of AdverTorch from PyPI.

```bash
pip install advertorch
```

--------------------------------

### Set up testing environments

Source: https://advertorch.readthedocs.io/en/latest/user/installation.html

Install specific versions of TensorFlow, CleverHans, Keras, and Foolbox required for testing AdverTorch attacks.

```bash
conda install -c anaconda tensorflow-gpu==1.11.0

```

```bash
pip install git+https://github.com/tensorflow/cleverhans.git@336b9f4ed95dccc7f0d12d338c2038c53786ab70

```

```bash
pip install Keras==2.2.2

```

```bash
pip install foolbox==1.3.2
```

--------------------------------

### Install AdverTorch in editable mode

Source: https://advertorch.readthedocs.io/en/latest/user/installation.html

Install AdverTorch from the source code in editable mode, which is useful for development.

```bash
pip install -e .
```

--------------------------------

### Visualize Adversarial Examples

Source: https://advertorch.readthedocs.io/en/latest/_tutorials/tutorial_attack_defense_bpda_mnist.html

Visualize clean data, defended clean data, adversarial examples, and defended adversarial examples. This snippet requires matplotlib for plotting.

```python
pred_cln = predict_from_logits(model(cln_data))
pred_cln_defended = predict_from_logits(model(cln_defended))
pred_adv = predict_from_logits(model(adv))
pred_adv_defended = predict_from_logits(model(adv_defended))

import matplotlib.pyplot as plt
plt.figure(figsize=(10, 10))
for ii in range(batch_size):
 plt.subplot(4, batch_size, ii + 1)
 _imshow(cln_data[ii])
 plt.title("clean \n pred: {}".format(pred_cln[ii]))
 plt.subplot(4, batch_size, ii + 1 + batch_size)
 _imshow(cln_data[ii])
 plt.title("defended clean \n pred: {}".format(pred_cln_defended[ii]))
 plt.subplot(4, batch_size, ii + 1 + batch_size * 2)
 _imshow(adv[ii])
 plt.title("adv \n pred: {}".format(n
 pred_adv[ii]))
 plt.subplot(4, batch_size, ii + 1 + batch_size * 3)
 _imshow(adv_defended[ii])
 plt.title("defended adv \n pred: {}".format(n
 pred_adv_defended[ii]))

plt.tight_layout()
plt.show()
```

--------------------------------

### Visualize Adversarial Examples on MNIST

Source: https://advertorch.readthedocs.io/en/latest/_tutorials/tutorial_attack_defense_bpda_mnist.html

This code snippet visualizes the original clean data, BPDA adversarial examples, and BPDA adversarial examples after defense. It displays the predicted class for each image. Ensure matplotlib is installed for visualization.

```python
pred_cln = predict_from_logits(model(cln_data))
pred_bpda_adv = predict_from_logits(model(bpda_adv))
pred_bpda_adv_defended = predict_from_logits(model(bpda_adv_defended))

import matplotlib.pyplot as plt
plt.figure(figsize=(10, 8))
for ii in range(batch_size):
 plt.subplot(3, batch_size, ii + 1)
 _imshow(cln_data[ii])
 plt.title("clean 
 pred: {}".format(pred_cln[ii]))
 plt.subplot(3, batch_size, ii + 1 + batch_size)
 _imshow(bpda_adv[ii])
 plt.title("bpda adv 
 pred: {}".format(
 pred_bpda_adv[ii]))
 plt.subplot(3, batch_size, ii + 1 + batch_size * 2)
 _imshow(bpda_adv_defended[ii])
 plt.title("defended 
 bpda adv 
 pred: {}".format(
 pred_bpda_adv_defended[ii]))

plt.tight_layout()
plt.show()
```

--------------------------------

### Visualize Adversarial Examples on MNIST

Source: https://advertorch.readthedocs.io/en/latest/_tutorials/tutorial_attack_defense_bpda_mnist.html

Visualizes clean, untargeted adversarial, and targeted adversarial examples for a batch of MNIST data. It displays the original image, the adversarial image, and the predicted class for each.

```python
pred_cln = predict_from_logits(model(cln_data))
pred_untargeted_adv = predict_from_logits(model(adv_untargeted))
pred_targeted_adv = predict_from_logits(model(adv_targeted))

import matplotlib.pyplot as plt
plt.figure(figsize=(10, 8))
for ii in range(batch_size):
    plt.subplot(3, batch_size, ii + 1)
    _imshow(cln_data[ii])
    plt.title("clean \n pred: {}".format(pred_cln[ii]))
    plt.subplot(3, batch_size, ii + 1 + batch_size)
    _imshow(adv_untargeted[ii])
    plt.title("untargeted \n adv \n pred: {}".format(
    pred_untargeted_adv[ii]))
    plt.subplot(3, batch_size, ii + 1 + batch_size * 2)
    _imshow(adv_targeted[ii])
    plt.title("targeted to 3 \n adv \n pred: {}".format(
    pred_targeted_adv[ii]))

plt.tight_layout()
plt.show()
```

--------------------------------

### Initialize LinfPGDAttack adversary

Source: https://advertorch.readthedocs.io/en/latest/_tutorials/tutorial_attack_defense_bpda_mnist.html

Constructs an instance of LinfPGDAttack for generating adversarial examples. Key parameters include the model, loss function, perturbation budget (eps), number of iterations (nb_iter), step size (eps_iter), and clipping bounds.

```python
from advertorch.attacks import LinfPGDAttack

adversary = LinfPGDAttack(
    model, loss_fn=nn.CrossEntropyLoss(reduction="sum"), eps=0.15,
    nb_iter=40, eps_iter=0.01, rand_init=True, clip_min=0.0, clip_max=1.0,
    targeted=False)
```

--------------------------------

### Load MNIST Dataset and Model

Source: https://advertorch.readthedocs.io/en/latest/_tutorials/tutorial_attack_defense_bpda_mnist.html

Loads the MNIST dataset and a pre-trained LeNet-5 model for adversarial attack and defense experiments. Ensure you have torchvision and torch installed.

```python
import torch
import torchvision
import torchvision.transforms as transforms

from advertorch.utils import NormalizeByImageNetMeanStd
from advertorch.defenses import LocalSuppression


# Load MNIST dataset
transform = transforms.Compose([
    transforms.ToTensor(),
    NormalizeByImageNetMeanStd(mean=[0.1307], std=[0.3081])
])

trainset = torchvision.datasets.MNIST(root="./datasets", train=True, download=True, transform=transform)
trainloader = torch.utils.data.DataLoader(trainset, batch_size=128, shuffle=True, num_workers=2)
testset = torchvision.datasets.MNIST(root="./datasets", train=False, download=True, transform=transform)
testloader = torch.utils.data.DataLoader(testset, batch_size=100, shuffle=False, num_workers=2)

# Load pre-trained LeNet-5 model
# You can replace this with your own model loading logic
# For demonstration, we assume a model named 'model' is available
# model = LeNet5()
# model.load_state_dict(torch.load("lenet5_mnist.pth"))
# model.eval()

# Placeholder for model loading
print("MNIST dataset and LeNet-5 model loaded.")

```

--------------------------------

### Implement Adversarial Training Defense

Source: https://advertorch.readthedocs.io/en/latest/_tutorials/tutorial_attack_defense_bpda_mnist.html

Trains the model using adversarial examples generated on-the-fly. This defense technique aims to improve the model's robustness against attacks.

```python
from advertorch.utils importడం

# Adversarial Training
EPOCH = 5
LR = 0.001

optimizer = torch.optim.Adam(model.parameters(), lr=LR)
criterion = torch.nn.CrossEntropyLoss()

adversary_train = ProjectedGradientDescent(model, eps=0.1, eps_step=0.01, max_iter=100, 
                                           targeted=False, clip_min=0.0, clip_max=1.0, 
                                           num_classes=10, device=device)

for epoch in range(EPOCH):
    for i, (images, labels) in enumerate(train_loader):
        images = images.to(device)
        labels = labels.to(device)

        # Generate adversarial examples for training
        adv_images = adversary_train.perturb(images, labels)

        # Forward pass and backward pass, with adversarial examples
        optimizer.zero_grad()
        outputs = model(adv_images)
        loss = criterion(outputs, labels)
        loss.backward()
        optimizer.step()

        if (i + 1) % 100 == 0:
            print(f'Epoch [{epoch+1}/{EPOCH}], Step [{i+1}/{len(train_loader)}], Loss: {loss.item():.4f}')

# Save the adversarially trained model
torch.save(model.state_dict(), "lenet5_mnist_adv_trained.pth")

```

--------------------------------

### Load MNIST Dataset and Model

Source: https://advertorch.readthedocs.io/en/latest/_tutorials/tutorial_attack_defense_bpda_mnist.html

Loads the MNIST dataset and a pre-trained LeNet model for attack and defense experiments. Ensure you have torchvision installed.

```python
import torch
import torchvision
import torchvision.transforms as transforms

from advertorch.attacks import ProjectedGradientDescent
from advertorch.models import LeNet

# Device configuration
device = torch.device("cuda" if torch.cuda.is_available() else "cpu")

# LeNet5 Architecture
model = LeNet().to(device)
model.load_state_dict(torch.load("lenet5_mnist_weights.pth"))
model.eval()

# MNIST Dataset
transform = transforms.Compose([
    transforms.ToTensor(),
    transforms.Normalize((0.1307,), (0.3081,)),
])

train_dataset = torchvision.datasets.MNIST(root="./data", train=True, download=True, transform=transform)

test_dataset = torchvision.datasets.MNIST(root="./data", train=False, download=True, transform=transform)

# Data loader
train_loader = torch.utils.data.DataLoader(train_dataset, batch_size=100, shuffle=True)
test_loader = torch.utils.data.DataLoader(test_dataset, batch_size=100, shuffle=False)

```

--------------------------------

### Evaluate Defense: Adversarial Training

Source: https://advertorch.readthedocs.io/en/latest/_tutorials/tutorial_attack_defense_bpda_mnist.html

Demonstrates Adversarial Training, a robust defense method where the model is trained on adversarial examples to improve its resilience.

```python
from advertorch.attacks import LinfPGDAttack
from advertorch.utils import NormalizeByImageNetMeanStd

# Assume model, trainloader, testloader are defined
# model = ...
# trainloader = ...
# testloader = ...

# Initialize PGD attack for adversarial training
adversarial_training_attack = LinfPGDAttack(
    model, 
    loss_fn=torch.nn.CrossEntropyLoss(reduction="mean"),
    eps=0.1, 
    nb_iter=40, 
    eps_iter=0.01,
    clip_min=0.0,
    clip_max=1.0,
    # Use a different model for gradient estimation if available
    # grad_model=..., 
    device=torch.device("cuda" if torch.cuda.is_available() else "cpu")
)

# Adversarial training loop (simplified)
# for epoch in range(num_epochs):
#     for images, labels in trainloader:
#         adv_images = adversarial_training_attack.perturb(images, labels)
#         # Train model on adv_images and labels
#         # ... training logic ...

print("Adversarial Training setup complete.")

```

--------------------------------

### Implement BPDA Attack

Source: https://advertorch.readthedocs.io/en/latest/_tutorials/tutorial_attack_defense_bpda_mnist.html

Configures and applies the Projected Gradient Descent (BPDA) attack to generate adversarial examples. This attack uses projected gradients to find adversarial perturbations.

```python
adversary = ProjectedGradientDescent(model, eps=0.1, eps_step=0.01, max_iter=100, 
                                      targeted=False, clip_min=0.0, clip_max=1.0, 
                                      num_classes=10, device=device)

# Get one batch of data
images, labels = next(iter(test_loader))
images = images.to(device)
labels = labels.to(device)

# Generate adversarial examples
adv_images = adversary.perturb(images, labels)

```

--------------------------------

### PGDAttack

Source: https://advertorch.readthedocs.io/en/latest/advertorch/attacks.html

Implements the Projected Gradient Descent attack. It performs a specified number of steps to create adversarial examples within a given epsilon bound from the original input.

```APIDOC
## PGDAttack

### Description
The projected gradient descent attack (Madry et al, 2017). The attack performs nb_iter steps of size eps_iter, while always staying within eps from the initial point.

### Parameters
* **predict** – forward pass function.
* **loss_fn** – loss function.
* **eps** – maximum distortion.
* **nb_iter** – number of iterations.
* **eps_iter** – attack step size.
* **rand_init** – (optional bool) random initialization.
* **clip_min** – mininum value per input dimension.
* **clip_max** – maximum value per input dimension.
* **ord** – (optional) the order of maximum distortion (inf or 2).
* **targeted** – if the attack is targeted.

### perturb
Given examples (x, y), returns their adversarial counterparts with an attack length of eps.

#### Parameters
* **x** – input tensor.
* **y** – label tensor. - if None and self.targeted=False, compute y as predicted labels. - if self.targeted=True, then y must be the targeted labels.

#### Returns
Tensor containing perturbed inputs.
```

--------------------------------

### ElasticNetL1Attack

Source: https://advertorch.readthedocs.io/en/latest/advertorch/attacks.html

Implements the ElasticNet L1 Attack. This attack seeks adversarial examples by optimizing a combination of L1 and L2 norms.

```APIDOC
## ElasticNetL1Attack

### Description
Implements the ElasticNet L1 Attack. This attack seeks adversarial examples by optimizing a combination of L1 and L2 norms.

### Parameters
- **predict** (callable) - The model's prediction function.
- **num_classes** (int) - The number of classes in the model.
- **confidence** (float, optional) - The confidence of the adversarial examples. Defaults to 0.
- **targeted** (bool, optional) - If True, the attack is targeted. Defaults to False.
- **learning_rate** (float, optional) - The learning rate for the attack algorithm. Defaults to 0.01.
- **binary_search_steps** (int, optional) - Number of binary search steps to find the optimum. Defaults to 9.
- **max_iterations** (int, optional) - The maximum number of iterations. Defaults to 10000.
- **abort_early** (bool, optional) - If True, abort early if stuck in a local minimum. Defaults to False.
- **initial_const** (float, optional) - Initial value of the constant c. Defaults to 0.001.
- **clip_min** (float, optional) - Minimum value per input dimension. Defaults to 0.0.
- **clip_max** (float, optional) - Maximum value per input dimension. Defaults to 1.0.
- **beta** (float, optional) - Hyperparameter trading off L2 minimization for L1 minimization. Defaults to 0.01.
- **decision_rule** (str, optional) - EN or L1. Selects the final adversarial example based on the least elastic-net or L1 distortion criterion. Defaults to 'EN'.
- **loss_fn** (callable, optional) - The loss function to use. Defaults to None.

### Method
`perturb(self, x, y=None)`

### Parameters
- **x** (tensor) - The model's input tensor.
- **y** (tensor, optional) - The target labels. If None and self.targeted is False, y is computed as predicted labels. If self.targeted is True, y must be the targeted labels.

### Returns
- **tensor** - Adversarial examples.
```

--------------------------------

### Perform untargeted attack

Source: https://advertorch.readthedocs.io/en/latest/_tutorials/tutorial_attack_defense_bpda_mnist.html

Generates adversarial examples by applying the configured PGD attack to the clean data without a specific target label. The resulting adversarial samples are stored in `adv_untargeted`.

```python
adv_untargeted = adversary.perturb(cln_data, true_label)
```

--------------------------------

### CarliniWagnerL2Attack

Source: https://advertorch.readthedocs.io/en/latest/advertorch/attacks.html

Implements the Carlini and Wagner L2 Attack. This attack aims to find adversarial examples by minimizing a loss function that balances distortion and confidence.

```APIDOC
## CarliniWagnerL2Attack

### Description
Implements the Carlini and Wagner L2 Attack. This attack aims to find adversarial examples by minimizing a loss function that balances distortion and confidence.

### Parameters
- **predict** (callable) - The model's prediction function.
- **num_classes** (int) - The number of classes in the model.
- **confidence** (float, optional) - The confidence of the adversarial examples. Defaults to 0.
- **targeted** (bool, optional) - If True, the attack is targeted. Defaults to False.
- **learning_rate** (float, optional) - The learning rate for the attack algorithm. Defaults to 0.01.
- **binary_search_steps** (int, optional) - Number of binary search steps to find the optimum. Defaults to 9.
- **max_iterations** (int, optional) - The maximum number of iterations. Defaults to 10000.
- **abort_early** (bool, optional) - If True, abort early if stuck in a local minimum. Defaults to True.
- **initial_const** (float, optional) - Initial value of the constant c. Defaults to 0.001.
- **clip_min** (float, optional) - Minimum value per input dimension. Defaults to 0.0.
- **clip_max** (float, optional) - Maximum value per input dimension. Defaults to 1.0.
- **loss_fn** (callable, optional) - The loss function to use. Defaults to None.

### Method
`perturb(self, x, y=None)`

### Parameters
- **x** (tensor) - The model's input tensor.
- **y** (tensor, optional) - The target labels. If None and self.targeted is False, y is computed as predicted labels. If self.targeted is True, y must be the targeted labels.

### Returns
- **tensor** - Adversarial examples.
```

--------------------------------

### Perform targeted attack

Source: https://advertorch.readthedocs.io/en/latest/_tutorials/tutorial_attack_defense_bpda_mnist.html

Generates adversarial examples targeting a specific class (digit '3' in this case). The `targeted` attribute of the adversary is set to `True`, and a target tensor is provided to the `perturb` method.

```python
target = torch.ones_like(true_label) * 3
adversary.targeted = Truenadv_targeted = adversary.perturb(cln_data, target)
```

--------------------------------

### Import necessary libraries and set up device

Source: https://advertorch.readthedocs.io/en/latest/_tutorials/tutorial_attack_defense_bpda_mnist.html

Imports essential libraries for plotting, argument parsing, and PyTorch operations. It also sets up the computation device (GPU or CPU) and seeds the random number generator for reproducibility.

```python
import matplotlib.pyplot as pltn%matplotlib inlinen
import os
import argparse
import torchn
import torch.nn as nnn

from advertorch.utils import predict_from_logits
from advertorch_examples.utils import get_mnist_test_loadern
from advertorch_examples.utils import _imshown

torch.manual_seed(0)
use_cuda = torch.cuda.is_available()
device = torch.device("cuda" if use_cuda else "cpu")
```

--------------------------------

### Context Management Classes

Source: https://advertorch.readthedocs.io/en/latest/advertorch/context.html

Documentation for the context management classes in `advertorch.context`.

```APIDOC
## Class: `advertorch.context.ctx_noparamgrad`

### Description
Manages the context for operations where gradients for parameters should not be computed.

### Usage
```python
with ctx_noparamgrad(module):
    # Operations within this block will not compute gradients for module parameters
    pass
```

## Class: `advertorch.context.ctx_eval`

### Description
Manages the context for evaluating a module, typically disabling gradient computation and setting the module to evaluation mode.

### Usage
```python
with ctx_eval(module):
    # Operations within this block are for evaluation, gradients are disabled
    pass
```
```

--------------------------------

### advertorch.context

Source: https://advertorch.readthedocs.io/en/latest/genindex.html

This module provides context managers for controlling gradient computation and parameter tracking.

```APIDOC
## Module: advertorch.context

### Description
Provides context managers for gradient and parameter control.

### Classes
- ctx_eval
- ctx_noparamgrad

### Methods
- No specific methods listed at the module level, refer to class documentation.
```

--------------------------------

### Load a pre-trained MNIST model

Source: https://advertorch.readthedocs.io/en/latest/_tutorials/tutorial_attack_defense_bpda_mnist.html

Loads a LeNet5 model pre-trained on the MNIST dataset. Ensure the model file ('mnist_lenet5_clntrained.pt') is available in the specified path. The model is then moved to the appropriate device (CPU or GPU) and set to evaluation mode.

```python
from advertorch.test_utils import LeNet5
from advertorch_examples.utils import TRAINED_MODEL_PATH

filename = "mnist_lenet5_clntrained.pt"
# filename = "mnist_lenet5_advtrained.pt"

model = LeNet5()
model.load_state_dict(
    torch.load(os.path.join(TRAINED_MODEL_PATH, filename)))
model.to(device)
model.eval()
```

--------------------------------

### MomentumIterativeAttack

Source: https://advertorch.readthedocs.io/en/latest/advertorch/attacks.html

Implements the Momentum Iterative Attack. This attack uses momentum to accelerate the optimization process for generating adversarial examples.

```APIDOC
## MomentumIterativeAttack

### Description
The Momentum Iterative Attack (Dong et al. 2017). The attack performs nb_iter steps of size eps_iter, while always staying within eps from the initial point. The optimization is performed with momentum.

### Parameters
* **predict** – forward pass function.
* **loss_fn** – loss function.
* **eps** – maximum distortion.
* **nb_iter** – number of iterations
* **decay_factor** – momentum decay factor.
* **eps_iter** – attack step size.
* **clip_min** – mininum value per input dimension.
* **clip_max** – maximum value per input dimension.
* **targeted** – if the attack is targeted.
* **ord** – (optional) the order of maximum distortion (inf or 2).
```

--------------------------------

### Implement BPDA Attack

Source: https://advertorch.readthedocs.io/en/latest/_tutorials/tutorial_attack_defense_bpda_mnist.html

This snippet shows how to implement the Black-box Projected Gradient Descent Attack (BPDA) using Advertorch. It requires a model, input data, and labels.

```python
from advertorch.attacks import BPDA

# Assume model, images, labels are defined
# model = ...
# images = ...
# labels = ...

# Initialize BPDA attack
bpda_attack = BPDA(model=model, 
                    loss_fn=torch.nn.CrossEntropyLoss(), 
                    # Use a different loss for BPDA, e.g., targeted attack loss
                    # targeted_loss_fn=..., 
                    # targeted_label=..., 
                    epsilon=0.1, 
                    num_iterations=100, 
                    step_size=0.01, 
                    # Use a different model for gradient estimation if available
                    # grad_model=..., 
                    device=torch.device("cuda" if torch.cuda.is_available() else "cpu"))

# Generate adversarial examples
adv_images = bpda_attack.perturb(images, labels)

```

--------------------------------

### Construct Defenses using Preprocessing

Source: https://advertorch.readthedocs.io/en/latest/_tutorials/tutorial_attack_defense_bpda_mnist.html

Initializes a sequence of preprocessing defenses including JPEG filtering, Bit Squeezing, and Median Smoothing. These defenses are applied to the input data to mitigate adversarial attacks.

```python
from advertorch.defenses import MedianSmoothing2D
from advertorch.defenses import BitSqueezing
from advertorch.defenses import JPEGFilter

bits_squeezing = BitSqueezing(bit_depth=5)
median_filter = MedianSmoothing2D(kernel_size=3)
jpeg_filter = JPEGFilter(10)

defense = nn.Sequential(
    jpeg_filter,
    bits_squeezing,
    median_filter,
)
```

--------------------------------

### L2BasicIterativeAttack

Source: https://advertorch.readthedocs.io/en/latest/advertorch/attacks.html

Like GradientAttack but with several steps for each epsilon.

```APIDOC
## L2BasicIterativeAttack

### Description
Like GradientAttack but with several steps for each epsilon.

### Parameters
- **predict** (callable) - forward pass function.
- **loss_fn** (callable) - loss function.
- **eps** (float) - maximum distortion.
- **nb_iter** (int) - number of iterations.
- **eps_iter** (float) - attack step size.
- **clip_min** (float) - mininum value per input dimension.
- **clip_max** (float) - maximum value per input dimension.
- **targeted** (bool) - if the attack is targeted.

### Methods
#### perturb(x, y=None)

Given examples (x, y), returns their adversarial counterparts with an attack length of eps.

Parameters:
- **x** (tensor) - input tensor.
- **y** (tensor, optional) - label tensor. If None and self.targeted=False, compute y as predicted labels. If self.targeted=True, then y must be the targeted labels.

Returns:
- tensor - tensor containing perturbed inputs.
```

--------------------------------

### GradientSignAttack

Source: https://advertorch.readthedocs.io/en/latest/advertorch/attacks.html

Implements the Fast Gradient Sign Method (FGSM).

```APIDOC
## GradientSignAttack

### Description
One step fast gradient sign method (Goodfellow et al, 2014).

### Parameters
- **predict** (callable) - forward pass function.
- **loss_fn** (callable) - loss function.
- **eps** (float) - attack step size.
- **clip_min** (float) - mininum value per input dimension.
- **clip_max** (float) - maximum value per input dimension.
- **targeted** (bool) - indicate if this is a targeted attack.

### Methods
#### perturb(x, y=None)

Given examples (x, y), returns their adversarial counterparts with an attack length of eps.

Parameters:
- **x** (tensor) - input tensor.
- **y** (tensor, optional) - label tensor. If None and self.targeted=False, compute y as predicted labels. If self.targeted=True, then y must be the targeted labels.

Returns:
- tensor - tensor containing perturbed inputs.
```

--------------------------------

### Evaluate Defense: JPEG Compression

Source: https://advertorch.readthedocs.io/en/latest/_tutorials/tutorial_attack_defense_bpda_mnist.html

Shows how to use JPEG compression as a defense mechanism against adversarial attacks. This method aims to remove adversarial perturbations by compressing the image.

```python
from advertorch.defenses import JpegCompression

# Assume adv_images are defined
# adv_images = ...

# Initialize JPEG Compression defense
jpeg_defense = JpegCompression(quality=75) # Adjust quality as needed

# Apply defense to adversarial images
defended_images_jpeg = jpeg_defense(adv_images)

# Evaluate model accuracy on defended images
# outputs = model(defended_images_jpeg)
# ... calculate accuracy ...

```

--------------------------------

### Apply Defenses to Input Data

Source: https://advertorch.readthedocs.io/en/latest/_tutorials/tutorial_attack_defense_bpda_mnist.html

Applies the constructed defense pipeline to both adversarial and clean input data. This step processes the data through the sequence of filters to reduce adversarial perturbations.

```python
adv = adv_untargeted
adv_defended = defense(adv)
cln_defended = defense(cln_data)
```

--------------------------------

### advertorch.bpda

Source: https://advertorch.readthedocs.io/en/latest/genindex.html

This module contains utilities related to the Backward Pass Differentiable Approximation (BPDA) technique.

```APIDOC
## Module: advertorch.bpda

### Description
Contains implementations related to Backward Pass Differentiable Approximation (BPDA).

### Classes
- BPDAWrapper

### Methods
- No specific methods listed at the module level, refer to class documentation.
```

--------------------------------

### Evaluate Defense: Total Variance Minimization

Source: https://advertorch.readthedocs.io/en/latest/_tutorials/tutorial_attack_defense_bpda_mnist.html

Implements Total Variance Minimization (TVM) as a defense strategy. TVM smooths the image to reduce adversarial noise while preserving important features.

```python
from advertorch.defenses import TotalVarianceMinimization

# Assume adv_images and model are defined
# adv_images = ...
# model = ...

# Initialize Total Variance Minimization defense
tvm_defense = TotalVarianceMinimization(model=model, 
                                        num_iterations=10, 
                                        step_size=0.01, 
                                        # Use a different model for gradient estimation if available
                                        # grad_model=..., 
                                        device=torch.device("cuda" if torch.cuda.is_available() else "cpu"))

# Apply defense to adversarial images
defended_images_tvm = tvm_defense(adv_images)

# Evaluate model accuracy on defended images
# outputs = model(defended_images_tvm)
# ... calculate accuracy ...

```

--------------------------------

### Load MNIST test data

Source: https://advertorch.readthedocs.io/en/latest/_tutorials/tutorial_attack_defense_bpda_mnist.html

Loads the MNIST test dataset using a utility function. It fetches a batch of data and corresponding true labels, then moves them to the selected computation device.

```python
batch_size = 5
loader = get_mnist_test_loader(batch_size=batch_size)
for cln_data, true_label in loader:
    break
cln_data, true_label = cln_data.to(device), true_label.to(device)
```

--------------------------------

### advertorch.defenses

Source: https://advertorch.readthedocs.io/en/latest/genindex.html

This module includes classes for applying defenses against adversarial attacks, such as smoothing techniques.

```APIDOC
## Module: advertorch.defenses

### Description
Provides a collection of defense mechanisms against adversarial attacks.

### Classes
- AverageSmoothing2D
- BinaryFilter
- BitSqueezing
- ConvSmoothing2D
- GaussianSmoothing2D
- JPEGFilter
- Processor

### Methods
- No specific methods listed at the module level, refer to class documentation.
```

--------------------------------

### Implement BPDA Attack Wrapper

Source: https://advertorch.readthedocs.io/en/latest/_tutorials/tutorial_attack_defense_bpda_mnist.html

Wrap a defense mechanism with BPDA to enable adaptive attacks on non-differentiable components. This requires the BPDAWrapper from advertorch.bpda and a differentiable approximation function.

```python
from advertorch.bpda import BPDAWrapper
defense_withbpda = BPDAWrapper(defense, forwardsub=lambda x: x)
defended_model = nn.Sequential(defense_withbpda, model)
bpda_adversary = LinfPGDAttack(
 defended_model, loss_fn=nn.CrossEntropyLoss(reduction="sum"), eps=0.15,
 nb_iter=1000, eps_iter=0.005, rand_init=True, clip_min=0.0, clip_max=1.0,
 targeted=False)

bpda_adv = bpda_adversary.perturb(cln_data, true_label)
bpda_adv_defended = defense(bpda_adv)
```

--------------------------------

### advertorch.attacks

Source: https://advertorch.readthedocs.io/en/latest/genindex.html

This module contains various classes for performing adversarial attacks on machine learning models.

```APIDOC
## Module: advertorch.attacks

### Description
Provides a collection of adversarial attack classes.

### Classes
- Attack (Base class for attacks)
- CarliniWagnerL2Attack
- DDNL2Attack
- ElasticNetL1Attack
- FastFeatureAttack
- GradientAttack
- GradientSignAttack
- JacobianSaliencyMapAttack
- L1PGDAttack
- L2BasicIterativeAttack
- L2PGDAttack
- LBFGSAttack
- LinfBasicIterativeAttack
- LinfPGDAttack
- LocalSearchAttack
- MedianSmoothing2D
- MomentumIterativeAttack
- PGDAttack
- SinglePixelAttack
- SparseL1DescentAttack
- SpatialTransformAttack

### Methods
- perturb() (Common method for applying attacks)
```

--------------------------------

### Evaluate Defense: Feature Squeezing

Source: https://advertorch.readthedocs.io/en/latest/_tutorials/tutorial_attack_defense_bpda_mnist.html

Applies Feature Squeezing as a defense technique. This method reduces the input space by limiting color depth or applying spatial smoothing.

```python
from advertorch.defenses import FeatureSqueezing

# Assume adv_images and model are defined
# adv_images = ...
# model = ...

# Initialize Feature Squeezing defense
fs_defense = FeatureSqueezing(model=model, 
                              # Options: "bit_depth_reduction", "spatial_smoothing"
                              squeeze_type="bit_depth_reduction", 
                              # Use a different model for gradient estimation if available
                              # grad_model=..., 
                              device=torch.device("cuda" if torch.cuda.is_available() else "cpu"))

# Apply defense to adversarial images
defended_images_fs = fs_defense(adv_images)

# Evaluate model accuracy on defended images
# outputs = model(defended_images_fs)
# ... calculate accuracy ...

```

--------------------------------

### BPDAWrapper

Source: https://advertorch.readthedocs.io/en/latest/advertorch/bpda.html

BPDAWrapper is a class that wraps a forward module with a BPDA backward path. If forwardsub is provided, it is used instead of the backward path.

```APIDOC
## class advertorch.bpda.BPDAWrapper(forward, forwardsub=None, backward=None)

### Description
Wrap forward module with BPDA backward path. If forwardsub is not None, then ignore backward.

### Parameters
* **forward** - The forward module to wrap.
* **forwardsub** - Substitute forward function for BPDA. If provided, this will be used instead of the backward path.
* **backward** - Substitute backward function for BPDA.
```

--------------------------------

### Advertorch Attacks Overview

Source: https://advertorch.readthedocs.io/en/latest/advertorch/attacks.html

This section lists the available adversarial attack classes in Advertorch, along with a brief description of each.

```APIDOC
## Attacks

`Attack` | Abstract base class for all attack classes.
`GradientAttack` | Perturbs the input with gradient (not gradient sign) of the loss wrt the input.
`GradientSignAttack` | One step fast gradient sign method (Goodfellow et al, 2014).
`FastFeatureAttack` | Fast attack against a target internal representation of a model using gradient descent (Sabour et al.
`L2BasicIterativeAttack` | Like GradientAttack but with several steps for each epsilon.
`LinfBasicIterativeAttack` | Like GradientSignAttack but with several steps for each epsilon.
`PGDAttack` | The projected gradient descent attack (Madry et al, 2017).
`LinfPGDAttack` | PGD Attack with order=Linf
`L2PGDAttack` | PGD Attack with order=L2
`L1PGDAttack` | PGD Attack with order=L1
`SparseL1DescentAttack` | SparseL1Descent Attack
`MomentumIterativeAttack` | The Momentum Iterative Attack (Dong et al.
`LinfMomentumIterativeAttack` | The Linf Momentum Iterative Attack Paper: https://arxiv.org/pdf/1710.06081.pdf
`L2MomentumIterativeAttack` | The L2 Momentum Iterative Attack Paper: https://arxiv.org/pdf/1710.06081.pdf
`CarliniWagnerL2Attack` | The Carlini and Wagner L2 Attack, https://arxiv.org/abs/1608.04644
`ElasticNetL1Attack` | The ElasticNet L1 Attack, https://arxiv.org/abs/1709.04114
`DDNL2Attack` | The decoupled direction and norm attack (Rony et al, 2018).
`LBFGSAttack` | The attack that uses L-BFGS to minimize the distance of the original and perturbed images
`SinglePixelAttack` | Single Pixel Attack Algorithm 1 in https://arxiv.org/pdf/1612.06299.pdf
`LocalSearchAttack` | Local Search Attack Algorithm 3 in https://arxiv.org/pdf/1612.06299.pdf
`SpatialTransformAttack` | Spatially Transformed Attack (Xiao et al.
`JacobianSaliencyMapAttack` | Jacobian Saliency Map Attack This includes Algorithm 1 and 3 in v1, https://arxiv.org/abs/1511.07528v1
```

--------------------------------

### Evaluate Defense: Local Suppression

Source: https://advertorch.readthedocs.io/en/latest/_tutorials/tutorial_attack_defense_bpda_mnist.html

Demonstrates how to apply the Local Suppression defense mechanism to mitigate adversarial attacks. This defense aims to reduce the impact of adversarial perturbations.

```python
from advertorch.defenses import LocalSuppression

# Assume adv_images and model are defined
# adv_images = ...
# model = ...

# Initialize Local Suppression defense
ls_defense = LocalSuppression(model=model, 
                              threshold=0.7, 
                              # Use a different model for gradient estimation if available
                              # grad_model=..., 
                              device=torch.device("cuda" if torch.cuda.is_available() else "cpu"))

# Apply defense to adversarial images
defended_images = ls_defense(adv_images)

# Evaluate model accuracy on defended images
# outputs = model(defended_images)
# ... calculate accuracy ...

```

--------------------------------

### LinfBasicIterativeAttack

Source: https://advertorch.readthedocs.io/en/latest/advertorch/attacks.html

Like GradientSignAttack but with several steps for each epsilon. Also known as Basic Iterative Attack.

```APIDOC
## LinfBasicIterativeAttack

### Description
Like GradientSignAttack but with several steps for each epsilon. Aka Basic Iterative Attack.

### Parameters
- **predict** (callable) - forward pass function.
- **loss_fn** (callable) - loss function.
- **eps** (float) - maximum distortion.
- **nb_iter** (int) - number of iterations.
- **eps_iter** (float) - attack step size.
- **rand_init** (bool) - (optional) random initialization.
- **clip_min** (float) - mininum value per input dimension.
- **clip_max** (float) - maximum value per input dimension.
- **targeted** (bool) - if the attack is targeted.

### Methods
#### perturb(x, y=None)

Given examples (x, y), returns their adversarial counterparts with an attack length of eps.

Parameters:
- **x** (tensor) - input tensor.
- **y** (tensor, optional) - label tensor. If None and self.targeted=False, compute y as predicted labels. If self.targeted=True, then y must be the targeted labels.

Returns:
- tensor - tensor containing perturbed inputs.
```

--------------------------------

### LocalSearchAttack

Source: https://advertorch.readthedocs.io/en/latest/advertorch/attacks.html

Implements the Local Search Attack algorithm.

```APIDOC
## LocalSearchAttack

### Description
Local Search Attack Algorithm 3 in https://arxiv.org/pdf/1612.06299.pdf

### Parameters
- **predict** (callable) - forward pass function.
- **clip_min** (float) - mininum value per input dimension.
- **clip_max** (float) - maximum value per input dimension.
- **p** (float) - parameter controls pixel complexity.
- **r** (float) - perturbation value.
- **loss_fn** (callable) - loss function.
- **d** (int) - the half side length of the neighbourhood square.
- **t** (int) - the number of pixels perturbed at each round.
- **k** (int) - the threshold for k-misclassification.
- **round_ub** (int) - an upper bound on the number of rounds.
- **seed_ratio** (float) - ratio of seeds to use.
- **max_nb_seeds** (int) - maximum number of seeds.
- **comply_with_foolbox** (bool) - whether to comply with Foolbox.
- **targeted** (bool) - if the attack is targeted.

### Method
`perturb(self, x, y=None)`

### Parameters
- **x** (tensor) - the model’s input tensor.
- **y** (tensor, optional) - the model’s input labels. Defaults to None.
- **kwargs** - optional parameters used by child classes.

### Returns
- adversarial examples (tensor).
```

--------------------------------

### SinglePixelAttack

Source: https://advertorch.readthedocs.io/en/latest/advertorch/attacks.html

Implements the Single Pixel Attack algorithm.

```APIDOC
## SinglePixelAttack

### Description
Single Pixel Attack Algorithm 1 in https://arxiv.org/pdf/1612.06299.pdf

### Parameters
- **predict** (callable) - forward pass function.
- **max_pixels** (int) - max number of pixels to perturb.
- **clip_min** (float) - mininum value per input dimension.
- **clip_max** (float) - maximum value per input dimension.
- **loss_fn** (callable) - loss function
- **comply_with_foolbox** (bool) - whether to comply with Foolbox.
- **targeted** (bool) - if the attack is targeted.

### Method
`perturb(self, x, y=None)`

### Parameters
- **x** (tensor) - the model’s input tensor.
- **y** (tensor, optional) - the model’s input labels. Defaults to None.
- **kwargs** - optional parameters used by child classes.

### Returns
- adversarial examples (tensor).
```

--------------------------------

### JPEGFilter

Source: https://advertorch.readthedocs.io/en/latest/advertorch/defenses.html

Simulates the effect of JPEG compression, which can act as a defense by reducing adversarial perturbations.

```APIDOC
## advertorch.defenses.JPEGFilter

### Description
JPEG Filter.

### Parameters
- **quality** (int, optional) - quality of the output. Defaults to 75.
```

--------------------------------

### LBFGSAttack

Source: https://advertorch.readthedocs.io/en/latest/advertorch/attacks.html

Placeholder for LBFGSAttack documentation. This attack typically uses the L-BFGS optimization algorithm.

```APIDOC
## LBFGSAttack

### Description
Placeholder for LBFGSAttack documentation. This attack typically uses the L-BFGS optimization algorithm.

### Parameters
- **predict** (callable) - The model's prediction function.
- **num_classes** (int) - The number of classes in the model.
- **batch_size** (int, optional) - The batch size for optimization. Defaults to 1.
- **binary_search_steps** (int, optional) - Number of binary search steps to find the optimum. Defaults to 9.
- **max_iterations** (int, optional) - The maximum number of iterations. Defaults to 100.
- **initial_const** (float, optional) - Initial value of the constant c. Defaults to 0.01.
- **clip_min** (float, optional) - Minimum value per input dimension. Defaults to 0.
- **clip_max** (float, optional) - Maximum value per input dimension. Defaults to 1.
- **loss_fn** (callable, optional) - The loss function to use. Defaults to None.
- **targeted** (bool, optional) - If True, the attack is targeted. Defaults to False.
```

--------------------------------

### SparseL1DescentAttack

Source: https://advertorch.readthedocs.io/en/latest/advertorch/attacks.html

Implements the Sparse L1 Descent attack. This attack focuses on creating sparse adversarial perturbations.

```APIDOC
## SparseL1DescentAttack

### Description
SparseL1Descent Attack

### Parameters
* **predict** – forward pass function.
* **loss_fn** – loss function.
* **eps** – maximum distortion.
* **nb_iter** – number of iterations.
* **eps_iter** – attack step size.
* **rand_init** – (optional bool) random initialization.
* **clip_min** – mininum value per input dimension.
* **clip_max** – maximum value per input dimension.
* **targeted** – if the attack is targeted.
* **l1_sparsity** – proportion of zeros in gradient updates
```

--------------------------------

### BinaryFilter

Source: https://advertorch.readthedocs.io/en/latest/advertorch/defenses.html

Applies a binary thresholding filter, converting image values to binary.

```APIDOC
## advertorch.defenses.BinaryFilter

### Description
Binary Filter.

### Parameters
- **vmin** (float, optional) - min value. Defaults to 0.0.
- **vmax** (float, optional) - max value. Defaults to 1.0.
```

--------------------------------

### LinfPGDAttack

Source: https://advertorch.readthedocs.io/en/latest/advertorch/attacks.html

PGD Attack with order=Linf. This is a variant of the Projected Gradient Descent attack specifically using the L-infinity norm for bounding perturbations.

```APIDOC
## LinfPGDAttack

### Description
PGD Attack with order=Linf

### Parameters
* **predict** – forward pass function.
* **loss_fn** – loss function.
* **eps** – maximum distortion.
* **nb_iter** – number of iterations.
* **eps_iter** – attack step size.
* **rand_init** – (optional bool) random initialization.
* **clip_min** – mininum value per input dimension.
* **clip_max** – maximum value per input dimension.
* **targeted** – if the attack is targeted.
```

--------------------------------

### L2PGDAttack

Source: https://advertorch.readthedocs.io/en/latest/advertorch/attacks.html

PGD Attack with order=L2. This variant of PGD uses the L2 norm to constrain the adversarial perturbations.

```APIDOC
## L2PGDAttack

### Description
PGD Attack with order=L2

### Parameters
* **predict** – forward pass function.
* **loss_fn** – loss function.
* **eps** – maximum distortion.
* **nb_iter** – number of iterations.
* **eps_iter** – attack step size.
* **rand_init** – (optional bool) random initialization.
* **clip_min** – mininum value per input dimension.
* **clip_max** – maximum value per input dimension.
* **targeted** – if the attack is targeted.
```

--------------------------------

### BitSqueezing

Source: https://advertorch.readthedocs.io/en/latest/advertorch/defenses.html

Reduces the bit depth of an image, which can help in removing subtle adversarial noise.

```APIDOC
## advertorch.defenses.BitSqueezing

### Description
Bit Squeezing.

### Parameters
- **bit_depth** (int) - bit depth.
- **vmin** (float, optional) - min value. Defaults to 0.0.
- **vmax** (float, optional) - max value. Defaults to 1.0.
```

--------------------------------

### MedianSmoothing2D

Source: https://advertorch.readthedocs.io/en/latest/advertorch/defenses.html

Applies a 2D median filter for smoothing. This is effective at removing salt-and-pepper noise.

```APIDOC
## advertorch.defenses.MedianSmoothing2D

### Description
Median Smoothing 2D.

### Parameters
- **kernel_size** (int, optional) - aperture linear size; must be odd and greater than 1. Defaults to 3.
- **stride** (int, optional) - stride of the convolution. Defaults to 1.
```

--------------------------------

### DDNL2Attack

Source: https://advertorch.readthedocs.io/en/latest/advertorch/attacks.html

Implements the Decoupled Direction and Norm (DDN) L2 Attack. This attack iteratively refines the perturbation direction and norm.

```APIDOC
## DDNL2Attack

### Description
Implements the Decoupled Direction and Norm (DDN) L2 Attack. This attack iteratively refines the perturbation direction and norm.

### Parameters
- **predict** (callable) - The model's prediction function.
- **nb_iter** (int, optional) - Number of iterations. Defaults to 100.
- **gamma** (float, optional) - Factor to modify the norm at each iteration. Defaults to 0.05.
- **init_norm** (float, optional) - Initial norm of the perturbation. Defaults to 1.0.
- **quantize** (bool, optional) - Perform quantization at each iteration. Defaults to True.
- **levels** (int, optional) - Number of quantization levels (e.g., 256 for 8-bit images). Defaults to 256.
- **clip_min** (float, optional) - Minimum value per input dimension. Defaults to 0.0.
- **clip_max** (float, optional) - Maximum value per input dimension. Defaults to 1.0.
- **targeted** (bool, optional) - If True, the attack is targeted. Defaults to False.
- **loss_fn** (callable, optional) - The loss function to use. Defaults to None.

### Method
`perturb(self, x, y=None)`

### Parameters
- **x** (tensor) - Input tensor.
- **y** (tensor, optional) - Label tensor. If None and self.targeted is False, compute y as predicted labels. If self.targeted is True, then y must be the targeted labels.

### Returns
- **tensor** - Tensor containing perturbed inputs.
```