How many dimensions are required to find an adversarial example?