[ravel-bar-foo]

This is a fascinating paper. Does training on generated noisy images make the resultant classifier more resistant to standard adversarial examples?