Most ReLU Networks Suffer from $ ell^2$ Adversarial Perturbations. - Amit Daniely; Hadas Shacham (NeurIPS, 2020)