Fig. 9From: IPatch: a remote adversarial patchThe average attack performance with different patch locations, shifted from near-center of x to the bottom-rightBack to article page