S. Baluja and I. Fischer, “Learning to Attack: Adversarial Transformation Networks”, AAAI, vol. 32, no. 1, Apr. 2018.