Your analysis has the error that you are comparing something that can recognize a face from among a few thousand (a human) with something that is designed to re

Your analysis has the error that you are comparing something that can recognize a face from among a few thousand (a human) with something that is designed to recognize a face from among many millions (a facial recognition algorithm). Also, they addressed low pass filters and other image degradation techniques in the article, and almost every adversarial example paper addresses them, and works in spite of them. You're not the first person to think of that.