Delving into Transferable Adversarial Examples and Black-box Attacks
Gradient-Based Learning Applied to Document Recognition