they do say under a stronger attack pgd which is a fairly strong attack with 10 iterations at epsilon equals 16. noisy student training improves efficient net l2's accuracy from 1.1 percent to 4.4 percent and not this um like you know 1.1 percent really means the model is almost like dead this is lower this is like random performance and 4.4 is still a bit above random performance but um yeah you could probably you could probably get there by simply using any sort of noise in that case but still you can see that