@article{papernot2016transferability,
author = {Papernot, Nicolas and McDaniel, Patrick and Goodfellow, Ian},
journal = {arXiv preprint arXiv:1605.07277},
title = {{Transferability in machine learning: from phenomena to black-box attacks using adversarial samples}},
year = {2016}
}
Generally speaking, this paper first investigated the transferability of adversarial examples. This transferability not only exits in the models trained in same methods(neural networks and neural networks, or dicision tree and dicision tree), but also exits in models with different training methods(e.g. dicision tree and neural networks). The authors did several experiments to prove it.