Thanks for the article, Sebastian. I noticed that you used MSE as the loss function when fitting the model, and when created the adversarial image. That’s an unusual choice, as categorical crossentropy is the more conventional loss function. Is there a reason you chose MSE? I’ve been trying to create my own adversarial examples (with crossentropy loss), but my model typically makes the correct prediction even when my epsilon value is quite high and the perturbed image/digit looks very messy. Not yet clear what I’m doing wrong.