Before revision:  This defense degrades imitation model BLEU and attack transfer rates at some cost in  BLEU and inference speed.
After revision:  This defense degrades imitation model BLEU and attack transfer rates at some cost in the defender's BLEU and inference speed.