Before revision:  Moreover, to  evaluate the robustness of different models fairly , we adopt a challenging  setup, which dynamically generates new adversarial examples for each model.
After revision:  Moreover, to evaluate the robustness of different models fairly , we adopt a challenging evaluation setup, which dynamically generates new adversarial examples for each model.