That's not entirely true: > If we transfer adversarial examples from one model to another model trained with one of these defenses, the attack often succeeds,

That's not entirely true: > If we transfer adversarial examples from one model to another model trained with one of these defenses, the attack often succeeds, even when a direct attack on the second model would fail [PMG16]. http://www.cleverhans.io/security/privacy/ml/2017/02/15/why-attacking-machine-learning-is-easier-than-defending-it.html http://www.cleverhans.io/security/privacy/ml/2017/02/15/why-...