Before revision:  Moreover, to  evaluate the robustness of different models fairly , we adopt a challenging  setup, which dynamically generates new adversarial examples for each model.
After revision:  Moreover, to evaluate the robustness of different models fairly , we adopt a challenging setup, which generates a new set of adversarial examples targeting each model.