tres test data set is fairly close to the original training data point it's it won't it will be classified uh incorrectly however if my original cloud during training is larger you can see if i train a model it can maybe put the decision boundary here and then my test data point will be included in on that same side so that's kind of the idea behind generalizing better of course that's a vast simplification and also to say that this here is an fgsm attack so this is kind of the weakest attack in the adversarial perturbation spectrum