ShapeShifter: Robust Physical Adversarial Attack on Faster R-CNN Object Detector
Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples