I’m not familiar with foolbox, but it seems as if the attack expects your model to output a single tensor, while your model outputs two.
If you don’t need out0 for the training (or something else), just remove it from the return statement.