S. Alfeld, A. Vartanian, L. Newman-Johnson, and B. I. Rubinstein, “Attacking Data Transforming Learners at Training Time”, AAAI, vol. 33, no. 01, pp. 3167-3174, Jul. 2019.