They are still smooth and have low-frequency patterns, which seems to be the main difference from adversarial examples currently produced from DL models.
They are still smooth and have low-frequency patterns, which seems to be the main difference from adversarial examples currently produced from DL models.