code: def attack_single_step(self, x, eta, g_feat):
      
  
      adv_x = x + eta
      a_feat = self.model.fprop(adv_x)[self.layer]
  
      # feat.shape = (batch, c) or (batch, w, h, c)
      axis = list(range(1, len(a_feat.shape)))
  
      # Compute loss
      # This is a targeted attack, hence the negative sign
      loss = -reduce_sum(tf.square(a_feat - g_feat), axis)
  
      # Define gradient of loss wrt input
      grad, = tf.gradients(loss, adv_x)
  
      # Multiply by constant epsilon
      scaled_signed_grad = self.eps_iter * tf.sign(grad)
  
      # Add perturbation to original example to obtain adversarial example
      adv_x = adv_x + scaled_signed_grad
  
      # If clipping is needed,
      # reset all values outside of [clip_min, clip_max]
      if (self.clip_min is not None) and (self.clip_max is not None):
        adv_x = tf.clip_by_value(adv_x, self.clip_min, self.clip_max)
  
      adv_x = tf.stop_gradient(adv_x)
  
      eta = adv_x - x
      eta = clip_eta(eta, self.ord, self.eps)
  
      return eta
docs: TensorFlow implementation of the Fast Feature Gradient. This is a
      single step attack similar to Fast Gradient Method that attacks an
      internal representation.
  
      :param x: the input placeholder
      :param eta: A tensor the same shape as x that holds the perturbation.
      :param g_feat: model's internal tensor for guide
      :return: a tensor for the adversarial example