Chen, et al.. Measuring the Transferability of ℓ_∞ Attacks by the ℓ_2 Norm. 17 Feb. 2022.