“Current AI systems are not adversarially robust and are still easier to trick than humans.”