> Discussing defenses against this attack is outside the scope of this paper. Previous work suggested the use of adversarial sample training [15], Jacobian-base

> Discussing defenses against this attack is outside the scope of this paper. Previous work suggested the use of adversarial sample training [15], Jacobian-based reg- ularization [16], and distillation [31] as means to make DNNs robust to adversarial samples. It seems like it would be very simple (given you already generated the examples) to take half the generated adversarial examples and train your original model more with those examples to check effect (adversarial sample training). This has been shown the improve model performance while also nullifying this "attack" in other (practically similar) settings. At this point, practitioners should be doing that anyway to maximize accuracy. Attack is a strong word people like to latch onto; the paper could also be titled "Generating new training examples with transfer learning". That said, there is a very real contribution here as to new ways to generate adversarial examples (which should then be used as further training examples).