is achieved by the two networks having opposite optimisation objectives, so that the classifier is penalised when the adversary performs better.

The adversarial network consists of two hidden layers with 20 nodes and ReLu activation functions, and takes as an input the output of the classifier. The output of the adversary has three nodes (one for each smearing class) with a softmax activation function and a categorical cross entropy loss. The network is then trained as follows:

1.  The classifier is trained for three epochs using the Adam optimiser with a learning rate of 0.01 and a batch size of 500. A class weighting is applied to account for the higher frequency of background events in the training data.

2.  The adversary is trained on background events for three epochs using mini-batch gradient descent with a learning rate of 0.01 and a batch size of 500.

3.  The classifier is trained for one epoch with mini-batch gradient descent with a batch size of 500 and with a total loss function, $$\label{eq:combined_loss_class}
    \mathcal{L}_{\mathrm{tot}} = \mathcal{L}_{\mathrm{class}} - \alpha \mathcal{L}_{\mathrm{adv}}~.$$ Furthermore, two class weightings are applied: one to account for the higher frequency of background events that the classifier is trained on, and 