That would be convenient, but even when the machine learning models are implemented differently, as long as they accomplish the same task, the attacks often tra

That would be convenient, but even when the machine learning models are implemented differently, as long as they accomplish the same task, the attacks often transfer from one to another. Papernot et al.'s latest research suggests that it is the space of the embeddings within a network, rather than the weights and nodes themselves, which define the effectiveness of adversarial examples. Models which accomplish the same tasks often have spaces that overlap, and that overlap multiplies by dimensions, if I read it right.