diff --git a/fluid/adversarial/advbox/attacks/base.py b/fluid/adversarial/advbox/attacks/base.py
index eb9b1d480c9e5488ec622f0717efdd3e5684ea00..d322d8b5692d5831f0dd2474ea31e4ae81af43b3 100644
--- a/fluid/adversarial/advbox/attacks/base.py
+++ b/fluid/adversarial/advbox/attacks/base.py
@@ -52,6 +52,8 @@ class Attack(object):
         :param adversary: adversary
         :return: None
         """
+        assert self.model.channel_axis() == adversary.original.ndim
+
         if adversary.original_label is None:
             adversary.original_label = np.argmax(
                 self.model.predict(adversary.original))
diff --git a/fluid/adversarial/advbox/attacks/gradient_method.py b/fluid/adversarial/advbox/attacks/gradient_method.py
index e7d42c4f95a126e6566dc8f3949038358481c948..70910136efe495529b8cdad105517d344a07af86 100644
--- a/fluid/adversarial/advbox/attacks/gradient_method.py
+++ b/fluid/adversarial/advbox/attacks/gradient_method.py
@@ -54,14 +54,12 @@ class GradientMethodAttack(Attack):
         if not isinstance(epsilons, Iterable):
             epsilons = np.linspace(epsilons, epsilons + 1e-10, num=steps)
 
-        print(epsilons)
-
         pre_label = adversary.original_label
         min_, max_ = self.model.bounds()
 
-        print self.model.channel_axis()
         assert self.model.channel_axis() == adversary.original.ndim
-        assert (self.model.channel_axis() == adversary.original.shape[0] or
+        assert (self.model.channel_axis() == 1 or
+                self.model.channel_axis() == adversary.original.shape[0] or
                 self.model.channel_axis() == adversary.original.shape[-1])
 
         adv_img = adversary.original
@@ -89,6 +87,8 @@ class GradientMethodAttack(Attack):
 
     @staticmethod
     def _norm(a, ord):
+        if a.ndim == 1:
+            return np.linalg.norm(a, ord=ord)
         if a.ndim == a.shape[0]:
             norm_shape = (a.ndim, reduce(np.dot, a.shape[1:]))
             norm_axis = 1