As far as I know, the elephant in the room problem [1] is still unsolved? Without support for double take, an adversary attack would still be fairly simple by simply including out of place information?

[1] https://www.quantamagazine.org/machine-learning-confronts-th...