That implies the amount of training is the only factor. It may be that new architectures or training methodologies could be developed to reject large swathes of

That implies the amount of training is the only factor. It may be that new architectures or training methodologies could be developed to reject large swathes of these types of advesarial examples. Though of course, if adversarial training is used avdersarial examples will obviously exist at some level, and so the arms race continues.