Tom McGrath says it is quite easy to make models behave erratically using adversarial examples in activation space.

“hmm so if you make activation um if you make like activation um stairs it's quite easy to get them to go bananas but you're right like the question here is like have they actually achieved they may have just achieved like extremely good coverage of essentially all input strings”