Since we know that these systems have "adversarial examples", are we sure there aren't "adversarial" people, people whose faces/gait/proportions throw off the a

Since we know that these systems have "adversarial examples", are we sure there aren't "adversarial" people, people whose faces/gait/proportions throw off the algorithm, which would not identify that real, adversarial, person as a detected person?