Protected images The perturbation noise level is set to $r=11/255$. We plan to release the perturbed images under other noise levels. Please stay tuned.