Mixture density networks (MDNs), first introduced by Christopher Bishop in 1994, are a type of neural network that output a probability distribution over categories.
I am wondering what an adversarial example would look like in an MDN. Usually an adversarial example causes the network to output the wrong class (for a small change in the input feature vector). How would an adversarial example be defined for an MDN? Has anyone seen such a definition in the literature?