Furthermore, recent works on adversarial perturbation have tackled this problem (Goodfellow et al., 2015;Feinman et al., 2017).
most previous approaches require either annotations generated by each individual annotator (Guan et al., 2017), or both task-specific and instance-type (genuine or adversarial) labels for training (Hendrik Metzen et al., 2017;Zheng et al., 2016), or noise-free data (Xiao et al., 2015).