Synthesizing Robust Adversarial Examples