Effect of Ambient-Intrinsic Dimension Gap on Adversarial Vulnerability