Targeted Adversarial Attack — chair → cat

Projected Gradient Descent (iterated FGSM) against MobileNet. We nudge the input pixels — each step bounded by ε in max-norm — toward the model's cat classes, until it reports "cat" while the image still looks like your chair to you. White-box on MobileNet; transfer to other models improves with smaller ε and more steps.