The subsequent images and conclusion that adverserial attacks against multiple models would be effective against humans seems tautological. Individual models ma

The subsequent images and conclusion that adverserial attacks against multiple models would be effective against humans seems tautological. Individual models may be unique, but multiple models are related in that -human- classifiers are the final source of truth. Anything that works against all of them is indirectly targeting the human classifiers that unite them.