> everything I've seen on adversarial attacks against ML models relies on knowing the model or having a way to run the model against attacker-determined input

> everything I've seen on adversarial attacks against ML models relies on knowing the model or having a way to run the model against attacker-determined input I thought that actually turned out not to be the case quite a bit of the time. An attack that's trained against one model will often work against different models as well, because the various models, even if trained on different data, will often end up looking at similar features. I'm not an ML expert though, so maybe someone with more knowledge can chime in.