def _attack_lpips(
        self,
        x: np.ndarray,
        y: np.ndarray,
        eps: int | float | np.ndarray,
        eps_step: int | float | np.ndarray,
        max_iter: int,
        training_mode: bool,
    ) -> np.ndarray:
        """
        Compute adversarial examples with cross entropy and lpips distance.

        :param x: An array with the original inputs.
        :param y: Target values (class labels) one-hot-encoded of shape `(nb_samples, nb_classes)` or indices of shape
                  (nb_samples,). Only provide this parameter if you'd like to use true labels when crafting adversarial
                  samples. Otherwise, model predictions are used as labels to avoid the "label leaking" effect
                  (explained in this paper: https://arxiv.org/abs/1611.01236).
        :param eps: Maximum perturbation that the attacker can introduce.
        :param eps_step: Attack step size (input variation) at each iteration.
        :param max_iter: number of iterations of attack.
        :param training_mode: training mode of classifier for attack generation. training_mode=False puts classifier in
                                eval mode
        :return: Adversarial examples.
        """
        import torch

        x_t = torch.from_numpy(x.astype(ART_NUMPY_DTYPE)).to(self._classifier.device)
        y_t = torch.from_numpy(y.astype(ART_NUMPY_DTYPE)).to(self._classifier.device)
        adv_x = torch.clone(x_t)

        for i_max_iter in range(max_iter):
            adv_x = self._one_step_adv_example(adv_x, x_t, y_t, eps, eps_step, i_max_iter == 0, training_mode)

        return adv_x.cpu().detach().numpy()

        Compute adversarial examples with cross entropy and lpips distance.

        :param x: An array with the original inputs.
        :param y: Target values (class labels) one-hot-encoded of shape `(nb_samples, nb_classes)` or indices of shape
                  (nb_samples,). Only provide this parameter if you'd like to use true labels when crafting adversarial
                  samples. Otherwise, model predictions are used as labels to avoid the "label leaking" effect
                  (explained in this paper: https://arxiv.org/abs/1611.01236).
        :param eps: Maximum perturbation that the attacker can introduce.
        :param eps_step: Attack step size (input variation) at each iteration.
        :param max_iter: number of iterations of attack.
        :param training_mode: training mode of classifier for attack generation. training_mode=False puts classifier in
                                eval mode
        :return: Adversarial examples.
        
art/defences/trainer/adversarial_trainer_oaat_pytorch.py