The poster is not wrong. This attack only works against a specific model trained against a specific dataset. It does not work against models that understand tha

The poster is not wrong. This attack only works against a specific model trained against a specific dataset. It does not work against models that understand that a animal face is made up of sub features like a nose, two eyes and a mouth. In the end, this is a completely useless exercise and will not have any impact on mass image recognition. For this to even work the attack needs to be tailored to the exact weights in the neural network that is being attacked.