Here is the table from the original paper. Note this is for MNIST, not more complicated datasets like Imagenet.<p><a href="http:&#x2F;&#x2F;i.imgur.com&#x2F;fJ35PTc.png" rel="nofollow">http:&#x2F;&#x2F;i.imgur.com&#x2F;fJ35PTc.png</a><p>It&#x27;s kind of confusing, but table 2 shows what percent of these adversarial images trained on one networked worked on another. It varies quite a bit, and many networks aren&#x27;t similar enough to each other for it to work reliably. But there is definitely some degree of generalization.