Fig. 1

Demonstration of the clean image, adversarial examples (AE) made by existing adversarial attack methods and our mothods on MLP-Mixer, and their GradCam images generated on VGG-16. The adversarial examples generated by the original method still make the target model focus on the object itself. Our method can force the target model to pay more attention to the regions far from the object in the adversarial examples