If we only allow a character to be replaced by another character nearby on the keyboard, already for this short sentence we need to exhaustively search over 2,951 possible perturbations.
the true class logit should be greater or equal than those for all other classes y, which means the prediction remains constant.