Applying some form of transformation is a weak countermeasure to adversarial examples. Especially simple ones such as low pass filters. https://arxiv.org/pdf/1

Applying some form of transformation is a weak countermeasure to adversarial examples. Especially simple ones such as low pass filters. https://arxiv.org/pdf/1707.07397.pdf https://arxiv.org/pdf/1707.07397.pdf Neural Networks do not learn what humans learn. They can learn completely different and sometimes much smaller features.