Figure 2 shows that two black-box methods (i.e., Content, Frequency) perform only slightly better than the Random method.
the Frequency method demonstrates even worse performances under the Mask perturbation.