Abstract: The traditional perturbation generation technique in the process of adversarial example generation requires a large amount of perturbation, which makes the example easy to be detected. An ...