Here is the table from the original paper. Note this is for MNIST, not more complicated datasets like Imagenet. http://i.imgur.com/fJ35PTc.png http://i.imgur.c

Here is the table from the original paper. Note this is for MNIST, not more complicated datasets like Imagenet. http://i.imgur.com/fJ35PTc.png http://i.imgur.com/fJ35PTc.png It's kind of confusing, but table 2 shows what percent of these adversarial images trained on one networked worked on another. It varies quite a bit, and many networks aren't similar enough to each other for it to work reliably. But there is definitely some degree of generalization.