def test_no_auto_append(art_warning, fix_get_synthetic_data, fix_make_dummy_model):
    """
    Verify behaviour when not spilling extra perturbation into an append attack
    """
    try:

        def generate_synthetic_slack_regions(size):
            """
            Generate 4 slack regions per sample, each of size 250.
            """

            batch_of_slack_starts = []
            batch_of_slack_sizes = []

            for _ in range(5):
                size_of_slack = []
                start_of_slack = []
                start = 0
                for _ in range(4):
                    start += 1000
                    start_of_slack.append(start)
                    size_of_slack.append(size)
                batch_of_slack_starts.append(start_of_slack)
                batch_of_slack_sizes.append(size_of_slack)
            return batch_of_slack_starts, batch_of_slack_sizes

        # 6th check: Do not automatically append extra perturbation
        l0_budget = 1250
        param_dic = {"maxlen": 2**20, "input_dim": 257, "embedding_size": 8}
        attack = MalwareGDTensorFlow(
            classifier=fix_make_dummy_model[0],
            embedding_weights=fix_make_dummy_model[1],
            l_0=l0_budget,
            param_dic=param_dic,
        )
        x = np.copy(fix_get_synthetic_data[0])
        y = np.copy(fix_get_synthetic_data[1])
        size_of_files = np.copy(fix_get_synthetic_data[2])

        attack.l_0 = l0_budget

        batch_of_section_starts, batch_of_section_sizes = generate_synthetic_slack_regions(size=250)
        adv_x, adv_y, adv_sizes, batch_of_section_starts, batch_of_section_sizes = attack.pull_out_valid_samples(
            x,
            y,
            sample_sizes=size_of_files,
            perturb_starts=batch_of_section_starts,
            perturb_sizes=batch_of_section_sizes,
            automatically_append=False,
        )
        # should have 3 samples.
        # 2nd datapoint cannot support any modification
        # 5th is a benign sample
        assert len(adv_x) == 3

        adv_x = attack.generate(
            adv_x,
            adv_y,
            adv_sizes,
            automatically_append=False,
            perturb_sizes=batch_of_section_sizes,
            perturb_starts=batch_of_section_starts,
        )

        j = 0
        for i in range(len(fix_get_synthetic_data[0])):
            if i in [0, 2, 3]:
                slack_starts = batch_of_section_starts[j]
                slack_sizes = batch_of_section_sizes[j]
                beginning_pos = 0
                total_perturbation = 0
                for slack_start, slack_size in zip(slack_starts, slack_sizes):
                    assert np.array_equal(
                        adv_x[j, beginning_pos:slack_start], fix_get_synthetic_data[0][i, beginning_pos:slack_start]
                    )

                    assert not np.array_equal(
                        adv_x[j, slack_start : slack_start + slack_size],
                        fix_get_synthetic_data[0][i, slack_start : slack_start + slack_size],
                    )
                    # set the position to the end of the slack region
                    beginning_pos = slack_start + slack_size
                    total_perturbation += slack_size
                # from end of final inserted perturbation to EOF.
                assert np.array_equal(adv_x[j, beginning_pos:], fix_get_synthetic_data[0][i, beginning_pos:])
                j += 1
    except ARTTestException as e:
        art_warning(e)

    Verify behaviour when not spilling extra perturbation into an append attack
    
tests/attacks/evasion/test_pe_malware_attack.py