def body(i, old_adv_x, old_loss, labels=labels):
      """Find example with max loss value amongst batch of perturbations."""
      deltas = tf.random_uniform(deltas_shape)

      # generate uniform samples from the l^p unit ball interior
      if self.ord == np.inf:
        deltas *= 2. * self.eps
        deltas -= self.eps
      elif self.ord == 1:
        # ref: https://mathoverflow.net/questions/9185/how-to-generate-random-points-in-ell-p-balls  pylint: disable=line-too-long
        exp = -tf.log(deltas)
        shift = -tf.log(tf.random_uniform(deltas_shape[:2]))
        norm = tf.reduce_sum(tf.abs(exp), range(2, len(deltas_shape) - 2))
        scale = tf.reshape(shift + norm,
                           deltas_shape[:2] + [1] * (len(deltas_shape) - 2))
        deltas = exp / scale
      elif self.ord == 2:
        # ref: https://blogs.sas.com/content/iml/2016/04/06/generate-points-uniformly-in-ball.html  pylint: disable=line-too-long
        dims = tf.reduce_prod(deltas_shape[2:])
        deltas = tf.pow(deltas, 1. / dims)
        normal = tf.random_normal(deltas)
        normal /= tf.sqrt(
            tf.reduce_sum(normal**2, axis=range(2,
                                                len(deltas_shape) - 2)),
            keepdims=True)
        deltas *= normal
      else:
        raise NotImplementedError('Only L-inf, L1 and L2 norms are '
                                  'currently implemented.')

      adv_x = tf.expand_dims(x, 1) + deltas
      labels = tf.expand_dims(labels, 1)
      labels = tf.tile(labels, [1, self.num_samples, 1])

      if (self.clip_min is not None) and (self.clip_max is not None):
        adv_x = tf.clip_by_value(adv_x, self.clip_min, self.clip_max)

      adv_x_r = tf.reshape(adv_x, [-1] + deltas_shape[2:])
      preds = self.model.get_probs(adv_x_r)
      preds_shape = preds.shape.as_list()
      preds = tf.reshape(preds, deltas_shape[:2] + preds_shape[1:])

      if labels is None:
        # Using model predictions as ground truth to avoid label leaking
        preds_max = tf.reduce_max(preds, -1, keep_dims=True)
        labels = tf.to_float(tf.equal(preds, preds_max))
        labels = tf.stop_gradient(labels)
      labels = labels / tf.reduce_sum(labels, -1, keep_dims=True)

      # Compute loss
      loss = utils_tf.model_loss(labels, preds, mean=False)
      if self.y_target is not None:
        loss = -loss

      # find the maximum loss value
      input_idx = tf.one_hot(tf.argmax(loss, axis=1), self.num_samples, axis=1)
      loss = tf.reduce_sum(loss * input_idx, axis=1)
      input_idx = tf.reshape(input_idx,
                             deltas_shape[:2] + [1] * (len(deltas_shape) - 2))
      adv_x = tf.reduce_sum(adv_x * input_idx, axis=1)

      condition = tf.greater(old_loss, loss)
      new_loss = tf.where(condition, old_loss, loss)
      new_adv_x = tf.where(condition, old_adv_x, adv_x)
      print(new_loss, new_adv_x)

      return i + 1, new_adv_x, new_loss
Find example with max loss value amongst batch of perturbations.
tensor2tensor/utils/adv_attack_utils.py