X. Mao, Y. Chen, S. Wang, H. Su, Y. He, and H. Xue, “Composite Adversarial Attacks”, AAAI, vol. 35, no. 10, pp. 8884-8892, May 2021.