I can paint a road to a tunnel on a mountain side and fool some amount of people. Meep. Meep.

The problem isn't that there are adversarial inputs. The problem is that the adversarial inputs aren't also adversarial (or detectable) to the human visual system.