Spatially Transformed Adversarial Examples
Intriguing properties of neural networks