Towards properties of adversarial image perturbations

Re-assign community