Create examples by modifications ”imperceptible to the human eye”, but where the model fails