Adversarially Robust Generalization Requires More Data
Intriguing Properties of Adversarial Examples