Quantifying the preferential direction of the model gradient in adversarial training with projected gradient descent

Ricardo Bigolin Lanfredi, Joyce D. Schroeder, Tolga Tasdizen