Bilevel Models for Adversarial Learning and A Case Study