Spatially Transformed Adversarial Examples