> So if there's hundreds of millions of dollars in profit from messing with AI results, expect a similar amount to be spent trying to defeat every single counte

> So if there's hundreds of millions of dollars in profit from messing with AI results, expect a similar amount to be spent trying to defeat every single countermeasure you will imagine. It's how it always works. Unfortunately that’s not how it has worked in machine learning security. Generally speaking (and this is very general and overly broad), it has always been easier to attack than defend (financially and effort wise). Defenders end up spending a lot more than attackers for robust defences, I.e. not just filtering out phrases. And, right now, there are probably way more attackers. Caveat — been out of the MLSec game for a bit. Not up with SotA. But we’re clearly still not there yet.