Towards properties of adversarial image perturbations | doi.page