3 ms·

Also: > This departs from most prior work on adversarial perturbations in the fact that this perturbation is universal in that it works for any background.