appreciate written clearly presented .
–Neural Information Processing Systems
We further experimented with boundary attack for11 attacking the model and detection mechanism as a black box, as suggested. Reviewer352 Methodology: We believe there is a misunderstanding regarding the core principle of our approach.
