Fig. 6From: DTA: distribution transform-based attack for query-limited scenarioThe performance of DTA when using different numbers of attack models. Where the dataset is ImageNet and the noise budget \(\epsilon =16\)Back to article page