Baluja, Shumeet, and Ian Fischer. 2018. “Learning to Attack: Adversarial Transformation Networks”. Proceedings of the AAAI Conference on Artificial Intelligence 32 (1). https://doi.org/10.1609/aaai.v32i1.11672.