Adversarial Tranferability;Early stop;Adversarial Training;Non-robust Features
Early Stop And Adversarial Training Yield Better surrogate Model: Very Non-Robust Features Harm Adversarial Transferability