And last but not least: Contests such as the underhanded C contest show that it is quite easy in sufficiently expressive formal systems) to create malicious outputs with high plausible deniability. Since training ML systems is even more expressive than that, the existence of such successful contests seems worrying