def _get_heatmap(
        self,
        x: np.ndarray,
        x_noise: np.ndarray,
        x_tar_noise: np.ndarray,
        mask: np.ndarray,
        y: int,
        patches: list[np.ndarray],
        xforms: list,
        clip_min: float,
        clip_max: float,
        pts: np.ndarray | None = None,
    ) -> list[float]:
        """
        Function to generate a heatmap.

        :param x: An array with one original input to be attacked.
        :param x_noise: x in the resolution of the noise size.
        :param x_tar_noise: x_tar in the resolution of the noise size.
        :param mask: An array with a mask to be applied to the adversarial perturbations. Shape needs to be
                     broadcastable to the shape of x. Any features for which the mask is zero will not be adversarially
                     perturbed.
        :param y: The target label.
        :param patches: List of patches from heatmap.
        :param xforms: List of transform params.
        :param clip_min: Minimum value of an example.
        :param clip_max: Maximum value of an example.
        :param pts: Optional. A set of points that will set the crop size in the perspective transform.
        :return: List of transform-robustness scores for the list of patches.
        """
        tr_scores = []

        # iterate over patches and compute transform_robustness without each individual patch
        for patch in patches:
            next_mask = mask * (np.ones(mask.shape) - patch)
            theta = (x_tar_noise - x_noise) * next_mask
            xform_imgs = get_transformed_images(
                x, next_mask, xforms, 1.0, theta, self.net_size, clip_min, clip_max, pts
            )
            success_rate = run_predictions(self.estimator, xform_imgs, y, self.batch_size, False)
            tr_scores.append(success_rate)

        return tr_scores

        Function to generate a heatmap.

        :param x: An array with one original input to be attacked.
        :param x_noise: x in the resolution of the noise size.
        :param x_tar_noise: x_tar in the resolution of the noise size.
        :param mask: An array with a mask to be applied to the adversarial perturbations. Shape needs to be
                     broadcastable to the shape of x. Any features for which the mask is zero will not be adversarially
                     perturbed.
        :param y: The target label.
        :param patches: List of patches from heatmap.
        :param xforms: List of transform params.
        :param clip_min: Minimum value of an example.
        :param clip_max: Maximum value of an example.
        :param pts: Optional. A set of points that will set the crop size in the perspective transform.
        :return: List of transform-robustness scores for the list of patches.
        
art/attacks/evasion/graphite/graphite_blackbox.py