Thank you, your comment along with the one further down by `Houshalter` helped me see something I was missing. I think it is still an interesting point to refl

Thank you, your comment along with the one further down by `Houshalter` helped me see something I was missing. I think it is still an interesting point to reflect on whether or not the adversarial examples "belong" in the population distribution or not. Take the example of the distorted Stop sign in the paper. It comes from the space of adversarial examples, but I think most of us would agree, as far as human perception goes, that that image should be considered part of whatever space comprises positive examples (if the system is trying to replicate human performance). Humans see it unequivocally as a Stop sign, so regardless of subtleties that make it non-natural, from the point of view of "I know it when I see it" it should be considered as if it were natural. So then the next question is whether all adversarial examples have to have that property. I mean, they obviously have to be good enough to fool the oracle, and potential any humans who check them out to see what's going on. In the other link that `Houshalter` shared, however, there is the example of random noise being classified as an ostrich. So in that case, we can see that input is non-sensical for the particular label. There would probably be some spectrum moving from obvious images to noise/gibberish images, all in the adversarial example space. And finding the line between them probably could not be any easier than the original learning problem in the first place. I'm just thinking out loud.