But why would different training data lead to the same error? I could imagine it would lead to something with the same type of flaw, but why do the same exact a

But why would different training data lead to the same error? I could imagine it would lead to something with the same type of flaw, but why do the same exact adversarial images work, out of the near infinite number of possible images? Doesn't intuitively make sense to me, but I can't say I have much of a background in machine learning. Like if you fit 5 close-to-linear 2d points with a 4th order polynomial, you'll overfit. Change the data slightly and you'll still overfit, but your fit will be very different.