Formulating Robustness Against Unforeseen Attacks

Neural networks have impressive performance on a variety of datasets (LeCun et al., 1998; He et al., 2015; Krizhevsky et al., 2017; Everingham et al., 2010) but can be fooled by imperceptible