The robustness of classifiers to small perturbations of the datapoints is a highly desirable property when the classifier is deployed in real and possibly hostile environments. Despite achieving excellent performance on recent visual benchmarks, state-of-the-art classifiers are surprisingly unstable to small perturbations of the data.