Provable defenses against adversarial examples via the convex outer adversarial polytope
On Detecting Adversarial Perturbations