Adversarial examples depend strongly on the classifier used because the researchers are directly analyzing the responses of the network. You would need to use t

Adversarial examples depend strongly on the classifier used because the researchers are directly analyzing the responses of the network. You would need to use the same model. This is also why the “anti-facial recognition” shirts are silly. If they had adversarial noise at all, you likely won’t know about or have access to the model you’re trying to fool.