Before revision:  Moreover, to  evaluate the robustness of different models fairly , we adopt a challenging  setup, which dynamically generates new adversarial examples for each model.
After revision:  Moreover, to fairly evaluate the robustness of different models fairly , we adopt a challenging setup, which dynamically generates new adversarial examples for each model.