Ghiasi, Shafahi, Goldstein, 2020. Breaking certified defenses: Semantic adversarial examples with spoofed robustness certificates.