Result Interpretation For Table 2 and 3 with Should-Not-Change strategies, lower is better in the first column (since a successful adversarial testing strategy will be effective at fooling the model), while higher is better in the second column (since successful adversarial training should bring the performance back up).
a proper response to the first utterance could be "Sure, I will bring you some coffee", but for the second one, the model should do anything but bring some coffee.