Thanks for this, I was looking for a simple way to apply adversarial samples during training!
I know it is intended for adversarial robustness, but do you think it can help classification accuracy in a similar way that AdvProp (https://arxiv.org/pdf/1911.09665v1.pdf 2) does?