[nhaliday]

What I find interesting is that the labels for the perturbed images aren't completely off in all cases, eg, wool for a shaggy dog.

[morenoh149]

that image also seems very black (the dog takes up most of the image) so the perturbations probably didn't have much to perturb. Also the perturbation is "universal" so it could have simply landed on the same classification.