def test_4_keras_mnist(self):
        """
        Second test with the KerasClassifier.
        :return:
        """
        x_test_original = self.x_test_mnist.copy()

        # Build KerasClassifier
        krc = get_image_classifier_kr()

        # set target label
        target = 0
        y_target = np.zeros([len(self.x_train_mnist), 10])
        for i in range(len(self.x_train_mnist)):
            y_target[i, target] = 1.0

        # Attack
        up = TargetedUniversalPerturbation(
            krc,
            max_iter=1,
            attacker="fgsm",
            attacker_params={
                "eps": 0.3,
                "targeted": True,
            },
        )
        x_train_adv = up.generate(self.x_train_mnist, y=y_target)
        self.assertTrue((up.fooling_rate >= 0.2) or not up.converged)

        x_test_adv = self.x_test_mnist + up.noise
        self.assertFalse((self.x_test_mnist == x_test_adv).all())

        train_y_pred = np.argmax(krc.predict(x_train_adv), axis=1)
        test_y_pred = np.argmax(krc.predict(x_test_adv), axis=1)
        self.assertFalse((np.argmax(self.y_test_mnist, axis=1) == test_y_pred).all())
        self.assertFalse((np.argmax(self.y_train_mnist, axis=1) == train_y_pred).all())

        # Check that x_test has not been modified by attack and classifier
        self.assertAlmostEqual(float(np.max(np.abs(x_test_original - self.x_test_mnist))), 0.0, delta=0.00001)

        Second test with the KerasClassifier.
        :return:
        
tests/attacks/test_targeted_universal_perturbation.py