Thanks for the link! Note that it’s not just adversarial robustness that is a problem, as the paper’s result merely with altering surface statistics with a Fou

Thanks for the link! Note that it’s not just adversarial robustness that is a problem, as the paper’s result merely with altering surface statistics with a Fourier domain filter applied to the training data already creates problems for interpreting the network’s internal representation as having any type of semantic representation of the underlying structure relevant for the task, without needing to involve the part about adversarial robustness at all.