Second, we regard the examples that confuse the classifier as good attacking examples and give them high reward to train the generator.
not all confusing examples are useful for robustness improvements.