We propose two variants of MHA, namely a black-box MHA (b-MHA) and a white-box MHA (w-MHA).
but the fluency of examples generated by genetic attack is still not satisfactory and it is inefficient as the gradient is discarded.