The paper presents different techniques, the first one is as they say in the thread model a "white-box scenario: the attacker knows the internals (architecture

The paper presents different techniques, the first one is as they say in the thread model a "white-box scenario: the attacker knows the internals (architecture and parameters) of the system being attacked". It means the images or glasses are crafted for a particular instance of an algorithm using its internal data. In their black-box scenario they "have no access to the internals of the training process and the model used", they do say that "dodging attacks with randomly colored glasses and found that it worked immediately for several images" using the previously generated model, but they did use "Particle Swarm Optimization" to modify their impersonation attack based on the result of the black-box recognition. It means you can't take their images and expect to work on your model, because mostly what they claim is specially crafted image can impersonate white or black box model using features or trial and errors.