Before revision:  Since adversarial attacks are the worst noise for the models, they should depend on the parameters of the models.
After revision:  Since adversarial attacks are optimized for models, they should depend on the parameters of the models.