Thank you, your comment along with the one further down by `Houshalter` helped me see something I was missing.<p>I think it is still an interesting point to reflect on whether or not the adversarial examples &quot;belong&quot; in the population distribution or not. Take the example of the distorted Stop sign in the paper. It comes from the space of adversarial examples, but I think most of us would agree, as far as human perception goes, that that image <i>should</i> be considered part of whatever space comprises positive examples (if the system is trying to replicate human performance). Humans see it unequivocally as a Stop sign, so regardless of subtleties that make it non-natural, from the point of view of &quot;I know it when I see it&quot; it should be considered as if it were natural.<p>So then the next question is whether all adversarial examples have to have that property. I mean, they obviously have to be good enough to fool the oracle, and potential any humans who check them out to see what&#x27;s going on.<p>In the other link that `Houshalter` shared, however, there is the example of random noise being classified as an ostrich. So in that case, we can see that input is non-sensical for the particular label. There would probably be some spectrum moving from obvious images to noise&#x2F;gibberish images, all in the adversarial example space. And finding the line between them probably could not be any easier than the original learning problem in the first place.<p>I&#x27;m just thinking out loud.