Adversarial Prompt Tuning for Vision-Language Models