Once this is specified, we aim to find k adversarial distributions {α (1) , ..., α (k) }, such that each α (i) maximizes the distance from originalα but does not change the output by more than .
this is the exception rather than the rule.