A general metric for identifying adversarial images
Adversarial examples in the physical world