Improving Model Generalization by On-manifold Adversarial Augmentation in the Frequency Domain.