As unfluent adversarial examples are not in the manifold of real sentences, the victim model only needs to adjust its decision boundary out of the sentence manifold to fit them.
fluent adversarial examples may be more effective than unfluent ones.