Compared to Att 2, Att 2+AT considers the adversarial perturbation and training that can alleviate overfitting.
att 2+aT is superior to att 2, which can prove the effectiveness of adversarial training.