Spatially Transformed Adversarial Examples
The Limitations of Deep Learning in Adversarial Settings