An adversarial attack that accounts for the real-world cost or feasibility of modifying each feature.