benchmarking neural network robustness to common corruptions and perturbations .
Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods