3 论文方法 特征级别的攻击在生成对抗样本的过程中会破坏掉积极的特征从而扩大消极的特征。因此，由特征级别生成的对抗样本可有继承误导其他A:=∑i=1N2(xi−xi′)∫01∂F∂xi(x′+α(x−x′))dαA:=\sum\limits_{i=1}^{N^2}(x_i-x^{\prime}_i)\int_0^1\frac{\partial F}{\partial x_i}(x^{\prime}+\alpha(x-x^{\prime}))d\alphaA:=i=1∑N2​(xi​−xi′​)∫0