> Of course the real answer is to just never expose the model to situations where an adversarial input could possibly lead to an undesired output. But that drastically limits what you can do with it.

Does it though? Isn't that what CPUs are, very fast-not-so-clever computing brain surrounded by layers that protect it?