On the Limitation of MagNet Defense against $L_1$-based Adversarial Examples

Open in new window