They don't work, and nothing in the category can ever truly work. Models and adversarial data are equally powerful - you can find an adversarial example for an

They don't work, and nothing in the category can ever truly work. Models and adversarial data are equally powerful - you can find an adversarial example for any current model, but you can also train a model that can handle any existing adversarial data. Any image is a good example of /something/ - at worst it's only an example of itself and irrelevant for any other class. Don't know if there's a name for this principle but it's kind of like a Church-Turing thesis for data.