adding the distracting sentence as first instead of last sentence, made the adversarially-trained models to fail almost as badly as without adversarial training.
average Ensemble CNN 31.59 32.07 RNN-LSTM 32.61 32.17 Table 6: adversarial accuracies on the validation set under the sentence-level white-box attack based on removal of the plot sentence with highest attention (averaged results of nine models).