Baluja, S., and I. Fischer. “Learning to Attack: Adversarial Transformation Networks”. Proceedings of the AAAI Conference on Artificial Intelligence, vol. 32, no. 1, Apr. 2018, doi:10.1609/aaai.v32i1.11672.