Before revision:  Specifically, given an untrusted image, the adversarial perturbation is added to the input image intentionally, if the prediction of  model on the perturbed image is consistent with that on the unperturbed image, the input image will be considered as a backdoor instance.
After revision:  Specifically, given an untrusted image, the adversarial perturbation is added to the image intentionally. If the prediction of model on the perturbed image is consistent with that on the unperturbed image, the input image will be considered as a backdoor instance.