I know there has been work in generating adversarial images that work against multiple models. That kind of thing is probably only going to get better, to say n

I know there has been work in generating adversarial images that work against multiple models. That kind of thing is probably only going to get better, to say nothing of particular sets of weights in a single model.