The hard part of that would probably be getting unauthorized access to the photos in order to modify them in place, rather than the adversarial image perturbati

The hard part of that would probably be getting unauthorized access to the photos in order to modify them in place, rather than the adversarial image perturbation per-se.