The threat aspect of this is, indeed, largely a red herring. The relevance here is the current lack of robustness in the face of ambiguity. The line between ima

The threat aspect of this is, indeed, largely a red herring. The relevance here is the current lack of robustness in the face of ambiguity. The line between images that are properly identified and those that are not is very complicated, not well characterized, and (to some extent[1]) implementation-dependent. One might say that this is true of people too, but people have various higher-level skills for detecting and resolving ambiguity. [1] As this study found adversarial images that affect a number of different implementations, there is some implementation-independence, which may be helpful in solving the problem.