Most ReLU Networks Suffer from null 2 Adversarial Perturbations

Neural Information Processing Systems 

We consider ReLU networks with random weights, in which the dimension decreases at each layer.