Intriguing Properties of Adversarial Examples