(4) may not be sufficient for generating meaningful adversarial examples: they can lead neural NLI models to violate available background knowledge, but they may not be well-formed and meaningful.
if we just use the final decision made by the neural NLI model, we can simply check whether the rule is violated by two given sentences, without any information on the degree of such a violation.