Does it matter? Unless they're going to totally change the technology I don't see how they can do anything but buy time until it's reverse engineered. After all, the code runs locally.
If Apple wants to defend this they should try to explain how the system will work even if generating adversarial images is trivial.
If Apple wants to defend this they should try to explain how the system will work even if generating adversarial images is trivial.