Q. Xu, G. Tao, S. Cheng, and X. Zhang, “Towards Feature Space Adversarial Attack by Style Perturbation”, AAAI, vol. 35, no. 12, pp. 10523-10531, May 2021.