def _compute(
        self,
        x_adv: np.ndarray,
        x_init: np.ndarray,
        y: np.ndarray,
        cost_matrix: np.ndarray,
        eps: np.ndarray,
        err: np.ndarray,
    ) -> np.ndarray:
        """
        Compute adversarial examples for one iteration.

        :param x_adv: Current adversarial examples.
        :param x_init: An array with the original inputs.
        :param y: Target values (class labels) one-hot-encoded of shape `(nb_samples, nb_classes)` or indices of shape
                  (nb_samples,). Only provide this parameter if you'd like to use true labels when crafting adversarial
                  samples. Otherwise, model predictions are used as labels to avoid the "label leaking" effect
                  (explained in this paper: https://arxiv.org/abs/1611.01236). Default is `None`.
        :param cost_matrix: A non-negative cost matrix.
        :param eps: Maximum perturbation that the attacker can introduce.
        :param err: Current successful adversarial examples.
        :return: Adversarial examples.
        """
        # Compute and apply perturbation
        x_adv[~err] = self._compute_apply_perturbation(x_adv, y, cost_matrix)[~err]

        # Do projection
        x_adv[~err] = self._apply_projection(x_adv, x_init, cost_matrix, eps)[~err]

        # Clip x_adv
        if self.estimator.clip_values is not None:
            clip_min, clip_max = self.estimator.clip_values
            x_adv = np.clip(x_adv, clip_min, clip_max)

        return x_adv

        Compute adversarial examples for one iteration.

        :param x_adv: Current adversarial examples.
        :param x_init: An array with the original inputs.
        :param y: Target values (class labels) one-hot-encoded of shape `(nb_samples, nb_classes)` or indices of shape
                  (nb_samples,). Only provide this parameter if you'd like to use true labels when crafting adversarial
                  samples. Otherwise, model predictions are used as labels to avoid the "label leaking" effect
                  (explained in this paper: https://arxiv.org/abs/1611.01236). Default is `None`.
        :param cost_matrix: A non-negative cost matrix.
        :param eps: Maximum perturbation that the attacker can introduce.
        :param err: Current successful adversarial examples.
        :return: Adversarial examples.
        
art/attacks/evasion/wasserstein.py