This is actually a thing, yes (and it does increase robustness to adversarial examples). This is particularly useful if you apply (random) low-pass filtering (o

This is actually a thing, yes (and it does increase robustness to adversarial examples). This is particularly useful if you apply (random) low-pass filtering (or denoising, or DCT-based compression, or anything that messes up high-frequency content) to the image (besides random cropping/rescaling), since adversarial examples often rely on manipulating (human-imperceptible) high-frequency information.