Restricted-Area Adversarial Example Attack for Image Captioning Model

Table 1

Architecture of CNN model. The max pooling layer is , and the stride is 2.

Layer	Output shape	Input shape
Conv1		, 64, stride 2
Conv2_x
Conv3_x
Conv4_x
Conv5_x
FC		1000