Adversarial Robustness Toolbox. Trouble reproducing attack and defense example (ART black box attack using Tesseract)

I decided to study the attack on machine learning systems.

To do this, I used the Adversarial Robustness Toolbox library I tried to repeat the example: (Demonstrations of a black box attack on Tesseract OCR. Using BlackBoxClassifier and HopSkipJump to change one word image to another word image and apply preprocessing protection.

https://github.com/Trusted-AI/adversarial-robustness-toolbox/blob/main/notebooks/classifier_blackbox_tesseract.ipynb)

I did everything according to the instructions, used different IDEs, but I constantly encounter a problem when using jpeg compression, which involves protecting the classifier using image compression.

jpeg = JpegCompression(clip_values=(0, 255), channels_first=False)
classifier_def = BlackBoxClassifier(predict, image_target.shape, 3, clip_values=(0, 255),
                                   preprocessing_defences=[jpeg]

after which the subsequent code

# this is the image we want to target
plt.imshow(image_target)
plt.show()
print('Tesseract output is: ' + label_dict[np.argmax(classifier_def.predict(np.array([image_target], dtype=np.float32)))])`

gives an error message

TRACECALL
ValueError Traceback (most recent call last)
~\AppData\Local\Temp/ipykernel_2356/2307723873.py in <module>
      2 plt.imshow(image_target)
      3 plt.show()
----> 4 print('Tesseract output is: ' + label_dict[np.argmax(classifier_def.predict(np.array([image_target], dtype=np.float32)))])

~\anaconda3\lib\site-packages\art\estimators\classification\classifier.py in replacement_function(self, *args, **kwargs)
     69 if len(args) > 0:
     70 args = tuple(lst)
---> 71 return fdict[func_name](self, *args, **kwargs)
     72
     73 replacement_function.__doc__ = fdict[func_name].__doc__

~\anaconda3\lib\site-packages\art\estimators\classification\blackbox.py in predict(self, x, batch_size, **kwargs)
    121
    122 # Apply preprocessing
--> 123 x_preprocessed, _ = self._apply_preprocessing(x, y=None, fit=False)
    124
    125 # Run predictions with batching

~\anaconda3\lib\site-packages\art\estimators\estimator.py in _apply_preprocessing(self, x, y, fit)
    303 else:
    304 if preprocess.apply_predict:
--> 305 x, y = preprocess(x, y)
    306
    307 return x, y

~\anaconda3\lib\site-packages\art\defences\preprocessor\jpeg_compression.py in __call__(self, x, y)
    117 x_ndim = x.ndim
    118 if x_ndim not in [4, 5]:
--> 119 raise ValueError(
    120 "Unrecognized input dimension. JPEG compression can only be applied to image and video data."
    121)

ValueError: Unrecognized input dimension. JPEG compression can only be applied to image and video data.

Regardless of whether the previous code was executed or not.

I think it's the use of jpeg compression, which does not work correctly, perhaps due to the incompatibility of the versions of the numpy and art packages