But for every adversarial distortion algorithm, you’d in theory have to double your training set, wouldn’t you?