My interest is not really the existence of borderline-recognizable inputs, but how you would reach them. It's trivial to make any system classify wrong if you can add arbitrary amounts of noise. But how often can you trick a human by taking a full-frame broad daylight image and perturbing each pixel up to some limit? I expect the number to be pretty low, even if you're depriving them of the ability to perform more examinations of the object.