In all the experiments, each model was trained/fine-tuned on the original SQuAD v1.1 training set, and tested on each one of the generated adversarial datasets.
we see that all models are affected by these adversarial samples, but also found that some adversaries are model-specific because they do not affect all models as much as they affect the model they are targeting.