Each green/blue dot is a clean point. Boxes are its $\varepsilon$-ball. Red stars are adversarial points the attacker picks inside the ball.