In Figure 1, we plot the success rate of the adversary against an acceptable confidence score for the misclassification.
we consider the adversary successful only if the classifier misclassifies the instance with a given confidence score.