Given a classifier, we first generate input examples that are very close to original inputs (so should yield the same labels) yet are likely to be misclassified by the current model.
these adversarial examples are generated by adding small perturbations to the inputs in the direction that significantly increases the loss function of the classifier (worstcase perturbations).