./models saves the implementation of models we used in our work.
	./models/sn.py is the implementation of spectral normalization.

./tools/attack.py implements FGM and PGD attack.

Transferable_perturbation_ERM.py trains models by ERM.
Transferable_perturbation_SN.py and  Transferable_perturbation_early_stopping.py do adversarial training by different regularization strategies.

Test_Transferable_perturbation_ERM.py, Test_Transferable_perturbation_SN.py and  Test_Transferable_perturbation_early_stopping.py are used to evaluate the models generated from the above code.
