Merge pull request #1624 from TS-Lee/gm-shape-fix

Gradient matching unknown input shape support

Author: beat-buesser

art/attacks/poisoning/gradient_matching_attack.py

@@ -151,8 +151,8 @@ def __initialize_poison_tensorflow(
 
         :param x_trigger: A list of samples to use as triggers.
         :param y_trigger: A list of target classes to classify the triggers into.
-        :param x_train: A list of training data to poison a portion of.
-        :param y_train: A list of labels for x_train.
+        :param x_poison: A list of training data to poison a portion of.
+        :param y_poison: A list of true labels for x_poison.
         """
         # pylint: disable=no-name-in-module
         from tensorflow.keras import backend as K
@@ -190,7 +190,7 @@ def _weight_grad(classifier: TensorFlowV2Classifier, x: tf.Tensor, target: tf.Te
         y_true_poison = Input(shape=np.shape(y_poison)[1:])
         embedding_layer = Embedding(
             len(x_poison),
-            np.prod(input_poison.shape[1:]),
+            np.prod(x_poison.shape[1:]),
             embeddings_initializer=tf.keras.initializers.RandomNormal(stddev=self.epsilon * 0.01),
         )
         embeddings = embedding_layer(input_indices)