[jvns]

surprisingly, if you read the paper, the adversarial examples actually do generalize to some extent if you try them on another network!

[Houshalter]

Here is the table from the original paper. Note this is for MNIST, not more complicated datasets like Imagenet.

http://i.imgur.com/fJ35PTc.png

It's kind of confusing, but table 2 shows what percent of these adversarial images trained on one networked worked on another. It varies quite a bit, and many networks aren't similar enough to each other for it to work reliably. But there is definitely some degree of generalization.