Ignoring the policy side of things for now, as I'm sure we'll get plenty of discussion in other comments... On a technical level how well do these adversarial

Ignoring the policy side of things for now, as I'm sure we'll get plenty of discussion in other comments... On a technical level how well do these adversarial attacks survive trivial transformations on the original pixel data? I would imagine even a simple JPEG compression pass would ruin the effect.