Restricted-Area Adversarial Example Attack for Image Captioning Model

Figure 2

Attack success rate of the restricted adversarial example according to the size of the restricted area.