Z. Yang, Y. Han, and X. Zhang, “Characterizing the Evasion Attackability of Multi-label Classifiers”, AAAI, vol. 35, no. 12, pp. 10647–10655, May 2021.