This is another example of an adversarial defense that will be useless once the models are trained on input images that have been scrambled like these have.