Because all the adversarial images that are out there look like noise. If you are training each image with a different amount of noise on top of it, then plaus

Because all the adversarial images that are out there look like noise. If you are training each image with a different amount of noise on top of it, then plausibly you could train the classifier to be insensitive to noise like this overlaid on an image.