detecting adversarial examples is nearly as hard as classifying them published presentations and documents on DocSlides.