I'm not sure that screen-shotting the image will work FWIW - any rescaling interpolation in rendering the image on the page or loading it for a model will likely reduce or nullify the effect.

Also these perturbation based adversarial attacks are often model specific. You take the model's gradient at each pixel and iteratively perturbate the image to make it more and more confident that it's e.g. a cat.