Learning to Attack: Adversarial Transformation Networks