(1)
Levine, A.; Feizi, S. Robustness Certificates for Sparse Adversarial Attacks by Randomized Ablation. AAAI 2020, 34, 4585-4593.