Aren't adversarial examples have to be trained to be effective against a specific recognizer? I could imagine you could make one that was effective against mul

Aren't adversarial examples have to be trained to be effective against a specific recognizer? I could imagine you could make one that was effective against multiple recognizers, but not in general. I'd also guess it'd be easy to get rid of this vulnerability on the model side.