1. Those are examples for a network that does not use blurring. You have the be careful because, remember, the adversary can <i>tailor their examples</i> to whatever preprocessing you use. So the adversarial examples for a network with blurring would look completely different, but they would still exist. Randomness could just force the adversary to use a distribution over examples, and it could mean they are still able to fool you half the time instead of all the time. However, I wouldn&#x27;t trust my intuition here: that is really a question for the machine learning theory researchers (whether there is some random scheme that is provably resilient or if they&#x27;re all provably vulnerable, or proving some error bounds on resilience, etc.).<p>2. The problem of projecting an image onto a car&#x27;s camera already implies you&#x27;d be able to do it for a few seconds.