Indeed, but they change the dataset and keep the same algorithm. I didn't see anything about changing the algorithm in itself.
That's not very surprising: if you have enough training data, any large training set will be typical because it'll be average enough.
But when you choose a specific algorithm, you can exploit its weaknesses and throwing more data won't change anything. Change the algorithm will, though.
But why would different training data lead to the same error? I could imagine it would lead to something with the same type of flaw, but why do the same exact adversarial images work, out of the near infinite number of possible images? Doesn't intuitively make sense to me, but I can't say I have much of a background in machine learning.
Like if you fit 5 close-to-linear 2d points with a 4th order polynomial, you'll overfit. Change the data slightly and you'll still overfit, but your fit will be very different.
