Practical Black-Box Attacks against Machine Learning
Random sampling with a reservoir