Casper, S., Nadeau, M. & Kreiman, G. One thing to fool them all: generating interpretable, universal, and physically-realizable adversarial features. arXiv (2022). doi:10.48550/arXiv.2110.03605

Casper, S., Nadeau, M., Hadfield-Menell, D. & Kreiman, G. Robust Feature-Level Adversaries are Interpretability Tools. NeurIPS (2022). at <https://openreview.net/forum?id=lQ--doSB2o>