I think they might be referring [1], which shows that adversarial examples transfer to models such as decision trees and SVMs.

[1] https://arxiv.org/abs/1605.07277