The adversarial noise issue is not so hard to understand, it's just costly to correct. That link provides the explanation: if your classifier is not very regul

The adversarial noise issue is not so hard to understand, it's just costly to correct. That link provides the explanation: if your classifier is not very regularized, then the classification regions are going to be close and irregular, s.t. a small vector may lead you from one to another. It's more of a geometrical fact f you think of classification regions in those spaces (of high dimension). Guaranteeing a large minimum distance is hard (essentially why error correcting codes are pretty hard to encode/decode)