Consistency error with wrappers when reusing a classifier

[ririnicolae]

The following code yields an error when the second attack is called:

model = ResNet50(weights="imagenet")
classifier = KerasClassifier((0,255), model, use_logits=False)
wrapper_1 = QueryEfficientBBGradientEstimation(classifier, 100, 1/128., round_samples=1/255.)
attack_1 = FastGradientMethod(wrapper_1, eps=3)

adv_image_1=attack_1.generate(image)

wrapper_2 = QueryEfficientBBGradientEstimation(classifier, 20, 1/64., round_samples=1/255.)
attack_2= FastGradientMethod(wrapper_2, eps=2)

adv_image_2=attack_2.generate(image)

Infinite loop error:

RecursionError                            Traceback (most recent call last)
<ipython-input-23-e5163801e214> in <module>
----> 1 adv_image_2=attack_2.generate(image)~\Anaconda3\lib\site-packages\art\attacks\fast_gradient.py in generate(self, x, **kwargs)
   143             # Use model predictions as correct outputs
   144             logger.info('Using model predictions as correct labels for FGM.')
--> 145             y = get_labels_np_array(self.classifier.predict(x))
   146         else:
   147             y = params_cpy.pop(str('y'))~\Anaconda3\lib\site-packages\art\wrappers\query_efficient_bb.py in _wrap_predict(self, x, logits, batch_size)
   117         :rtype: `np.ndarray`
   118         """
--> 119         return self._predict(clip_and_round(x, self.clip_values, self.round_samples), logits, batch_size)... last 1 frames repeated, from the frame below ...~\Anaconda3\lib\site-packages\art\wrappers\query_efficient_bb.py in _wrap_predict(self, x, logits, batch_size)
   117         :rtype: `np.ndarray`
   118         """
--> 119         return self._predict(clip_and_round(x, self.clip_values, self.round_samples), logits, batch_size)RecursionError: maximum recursion depth exceeded while calling a Python object

This is because wrappers have side effects. Here both wrappers replace the predict function of the same original classifier. Quick fix is to use two separate instances of classifiers, one per wrapper, but long term a better solution could be designed.