It can never work. If it ever did work, it can be put into an adversarial training loop to make it stop working.