Usually clip, which is actually how this works — the examples are modified to be misclassified in clip, but look passable to a human.