Simultaneously Optimizing Perturbations and Positions for Black-box Adversarial Patch Attacks

Open in new window