Adversarial Risk and the Dangers of Evaluating Against Weak Attacks
Provable defenses against adversarial examples via the convex outer adversarial polytope