1/ Strong No Free Lunch Theorem for adversarial robustness arxiv.org/pdf/1810.04065…. As the size eps of the perturbations is slightly increased, a point is reached eps_* is eventually reached beyond which accuracy decreases exponentially fast. A few typos in there.

Please RT. 2/ Moreover, eps_* is comparable to the natural noise level on the problem, with a modulation factor which varies only logarithmic as a function of the particular classifier ==> adversarial robustness / non-robustness is more a property of data than of some magical classifier