Provable defenses against adversarial examples via the convex outer adversarial polytope
A Rotation and a Translation Suffice: Fooling CNNs with Simple Transformations