Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionality