Nice! I really appreciate the real-world testing and not just "proving" the NN can be fooled by running it against image files. This always seemed to me like a

Nice! I really appreciate the real-world testing and not just "proving" the NN can be fooled by running it against image files. This always seemed to me like a huge omission in reports about adversarial attacks, sure it can be fooled with pixel-perfect changes of input data, but would it survive literally any "real-world"-like environment? I am quite surprised it does!