I'm surprised that they found this surprising: >>"...however, to their surprise, the researchers discovered that adversarial training not only makes the models

I'm surprised that they found this surprising: >>"...however, to their surprise, the researchers discovered that adversarial training not only makes the models more robust against paraphrasing attacks, but it also makes them more accurate and versatile. >>“This was one of the surprising findings we had in this project. Initially, we started with the angle of robustness. But we found out that this method not only improves robustness, but also improves generalizability,” Wu says. “If instead of attacks, you just think about what is the best way to augment your model, paraphrasing is a very good generalization tool to increase the capability of your AI model.” These "AI" or "Deep Learning" models are (I thought) widely known, especially among the researchers, to have zero understanding of what they are categorizing, and essentially being mere (albeit massive) statistical pattern matchers, resulting in absurdities like the excellent turtle->rifle example at the beginning of the article. Of course, counter-training against these sensitivities would make zero progress towards any kind of even child-level understanding in the model. Yet it seems obvious that it should at least make the system more robust to random or deliberate noise. So I'm confused why they found it so surprising.