Transferable adversarial examples based on global smooth perturbations