Does the "robustness" provided by this method mostly just increase robustness against adversarial examples generated in the same manner as this model, or is it more general/broad robustness? In other words, let's say another new method to generate adversarial examples is discovered/used, will this method be robust against that new method as well (without having knowledge/training of what the new method is)?

Thank you very much

apart from correctly classifying of the adversarial neighbors, is there any advantage of the model trained this way? Is there any influence on test accuracy, for example?

perturbation based on reverse gradients... of what?

how can make test to this example?

7:40 Google does not know how to youtube.