THERMOMETER ENCODING: ONE HOT WAY TO RESIST
Practical Black-Box Attacks against Deep Learning Systems using Adversarial Examples.