A. Levine and S. Feizi, “Robustness Certificates for Sparse Adversarial Attacks by Randomized Ablation”, AAAI, vol. 34, no. 04, pp. 4585-4593, Apr. 2020.