After adversarial modifications, the performance of the original target models (those without the “-adv” suffix) drops dramatically (e.g. the overall accuracy of BERT on Quora drops from 94.6% to 24.1%), revealing that the target models are vulnerable to our adversarial examples. 
 Question: How much dramatically results drop for models on generated adversarial examples?
BERT on Quora drops from 94.6% to 24.1%