Idealised Bayesian Neural Networks Cannot Have Adversarial Examples: Theoretical and Empirical Study
Are Generative Classifiers More Robust to Adversarial Attacks?