Fig. 5From: Smooth adversarial examplesOperating characteristics of the attacks over MNIST. Attacks PGD2 and qPGD2 are tested with target distortion D∈[1,6]Back to article page