Gradient Masking Causes CLEVER to Overestimate Adversarial Perturbation Size
Comment on"Biologically inspired protection of deep networks from adversarial attacks"