It&#x27;s worth noting that this would usually trivial to protect against in practice by checking any attack vector against multiple different neural networks (ideally trained with different(ly permutated) data, and different architectures).<p>Having said that, the MNIST examples might fool multiple networks. But one should note that the &quot;3&quot; example would probably fool a lot of humans on a single casual glance.<p>Also, this paper gives an excellent way to build a feedback for adversarial training (maybe some kind of semi-supervised auto encoder thing?)<p>Edit: I noticed that Ian Goodfellow is a co-author of [1] so he&#x27;s probably thinking about the adversarial training idea.<p>[1] <a href="http:&#x2F;&#x2F;gitxiv.com&#x2F;posts&#x2F;eFw3ArCyvhaFJ6bzb&#x2F;adversarial-autoencoders" rel="nofollow">http:&#x2F;&#x2F;gitxiv.com&#x2F;posts&#x2F;eFw3ArCyvhaFJ6bzb&#x2F;adversarial-autoen...</a>