Attack models that are pretrained on ImageNet. (1) Attack single model or multiple models. (2) Apply white-box attacks or black-box attacks. (3) Apply non-targeted attacks or targeted attacks.
