Fig. (18)
Precisions achieved by our attacks relative to previously published attacks and 1% target benchmark (the darker area of each bar).