Because in the paper they tested the attack with 1x2^27 requests, then with 2x2^27 requests, then 3x2^27, etc etc.