In the light of [0], it seems that standard (not adversarially trained) NNs learn each and every feature which happens to correlate with a class label in a trai

In the light of [0], it seems that standard (not adversarially trained) NNs learn each and every feature which happens to correlate with a class label in a training set (including noise). So moving along adversarial gradient looks like noise. Take my interpretation with a (huge) grain of salt. [0] https://arxiv.org/abs/1805.12152 https://arxiv.org/abs/1805.12152