[hishnash]

What I hope they do is use many instances of the system trained with slightly different sets of training data, otherwise, you just need to learn how to trick one version (and it will be possible) and you can trick them all.

When attacking human-managed systems they may be slow to respond, weak and unable to detect everything. But they are also weak in very different ways and will respond in different ways.