Future generations of these attacks are going to be discovered by adversarial ML, not by humans. Models will be trained to exploit other models, in the same way that game-playing models are trained to play themselves. Unless we develop a stronger theory of what’s possible, defenses will be identical. Human beings saying things like “have you discovered any attacks” to other human beings is going to be meaningless data, and as quaint as writing large programs in assembly.