Defending against Adversarial Images using Basis Functions Transformations
Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples