Before revision:  We show that current state-of-the-art (SOTA) models are vulnerable to these simple black-box attacks.
After revision:  We show that state-of-the-art (SOTA) models are vulnerable to these simple black-box attacks.