Black-box attack against handwritten signature verification with region-restricted adversarial perturbations.