Implement model based constraints for adversarial training

[GeoffNN]

Replace $\max_\delta \mathcal L(f_\theta(x + \delta), y)$ with $\max_{g\in \mathcal G} L(f_\theta(g(x), y))$

Example: filter based models where $g$ is a piece-wise linear function.