[Houshalter]

Here is the table from the original paper. Note this is for MNIST, not more complicated datasets like Imagenet.

http://i.imgur.com/fJ35PTc.png

It's kind of confusing, but table 2 shows what percent of these adversarial images trained on one networked worked on another. It varies quite a bit, and many networks aren't similar enough to each other for it to work reliably. But there is definitely some degree of generalization.