Adding individual attacks for AutoAttack

[fra31]

Hi,

I started adding the individual attacks. Here the details.

AutoPGD: the class APGDTargeted is not a targeted attacks (doesn't check that the final adversarial example belongs to the target class), but rather optimizes a loss including the correct class and a target class (and loops over a few possible target classes).

FAB: in fab_with_threshold.py a variant of the FABAttack is added. Differently from the original one, once it finds adversarial perturbations with norm smaller than eps it stops. Similarly to APGDTargeted, FABTargeted is not a proper targeted attack, but consider just one possible target class (this is also necessary for datasets with many classes e.g. ImageNet).

Square: a black-box attack which is specific to images. It works for Linf and L2, untargeted and targeted attacks (in the classical sense here).

Probably the names of some files and attacks should be improved, but I'm not sure which is the best option. Also some classes like LinfSquareAttack could be useful.

What do you think?

[gwding]

@fra31 Thanks a lot for the contribution!
Since this is a big PR, it might take me some time to review. In the mean time, do you mind adding a benchmarking script like this https://github.com/BorealisAI/advertorch/blob/master/advertorch_examples/attack_benchmarks/benchmark_fast_adaptive_boundary.py , just to make sure that this implementation matches your original one?