def _poison__tensorflow(self, x_poison: np.ndarray, y_poison: np.ndarray) -> tuple[Any, Any]:
        """
        Optimize the poison by matching the gradient within the perturbation budget.

        :param x_poison: List of samples to poison.
        :param y_poison: List of the labels for x_poison.
        :return: A pair of poisoned samples, B-score (cosine similarity of the gradients).
        """
        self.backdoor_model.compile(loss=None, optimizer=self.optimizer)

        callbacks = [self.lr_schedule]
        if self.verbose > 0:
            from tqdm.keras import TqdmCallback

            callbacks.append(TqdmCallback(verbose=self.verbose - 1))

        # Train the noise.
        self.backdoor_model.fit(
            [x_poison, y_poison, np.arange(len(y_poison))],
            callbacks=callbacks,
            batch_size=self.batch_size,
            initial_epoch=self.initial_epoch,
            epochs=self.max_epochs,
            verbose=0,
        )
        [input_noised_, B_] = self.backdoor_model.predict(  # pylint: disable=invalid-name
            [x_poison, y_poison, np.arange(len(y_poison))], batch_size=self.batch_size
        )

        return input_noised_, B_

        Optimize the poison by matching the gradient within the perturbation budget.

        :param x_poison: List of samples to poison.
        :param y_poison: List of the labels for x_poison.
        :return: A pair of poisoned samples, B-score (cosine similarity of the gradients).
        
art/attacks/poisoning/gradient_matching_attack.py