“…In terms of accuracy, as demonstrated in Tab. 4, our technique surpasses all nine previous adversarial works [19], [20], [21], [22], [23], [24], [25], [26], [27] as well as non-adversarial methods [7], [11], [12], [16], [45], [46], [47], [48], [49], [50] by significant margins for all the three thresholds δ < 1.25, δ < 1.25 2 , and δ < 1.25 3 , but performs lower than the work in [51] with a small margin. In Tab.…”