I think the issue this article talks about has been widely discussed. E.g https://www-users.cs.umn.edu/~qzhao/adversarial.html https://www-users.cs.umn.edu/~qzh

I think the issue this article talks about has been widely discussed. E.g https://www-users.cs.umn.edu/~qzhao/adversarial.html https://www-users.cs.umn.edu/~qzhao/adversarial.html It is a very specific problem in the realm of ML in my opinion. The networks that were mentioned are large and often with millions of parameters. Such models will be more difficult to evaluate why it fails comparing with a simpler model. Besides, the trick to produce such adversarial examples is an optimisation problem in the same sense as a hacking attack that you perturb the input signals in a way that when using this trained gigantic function it maps to a specific classification. The solution is a certain noise, then you add 'noise-like' real life images to make sure the network would ignore (but human would pick out for the obvious).