Baluja, S.; Fischer, I. Learning to Attack: Adversarial Transformation Networks. AAAI 2018, 32.