Adversarial examples for generative models