The attack is performed on GT label and not on the label predicted by the model on the clean image

[cimice15]

I really appreciate yor nice work! But I think there is an error: the attack is performed on the GT label and not on the label predicted by the model on the clean image.

Hope to get your answer, thank you!