Evading the Adversary in Invariant Representation