2. Alice and Bob are deep learning engineers working at two rival start-ups. They are both trying to deliver the same neural network-based product. Alice and Bob do not have access to each other's models and code. However, they can query each other's models as much as they'd like. (i) Name a type of neural network attack that Alice cannot use against Bob's model and explain why it cannot be used in this case. (ii) How can Alice forge an image xiguana which looks like an iguana but will be wrongly classified as a plant by Bob's model? Give an iterative method and explicitly mention the loss function. (iii) Alice doesn't have access to Bob's network. How can she still generate an adversarial example using the method described above? (iv) To defend himself against Alice's attacks, Bob is thinking of using dropout. Dropout randomly shuts down certain neurons of the network and makes it more robust to changes in the input. Thus, Bob has the intuition that the network will be less vulnerable to adversarial examples. Is Bob correct? Explain why or why not