Adversarial Patch
attacking the madry defense model with l1 - based adversarial examples .