## 5 Experimental Results of the Noise Blowing-Up Method
### Phase 2: Running \(atk_{\mathcal{H},\mathcal{L}}^{scenario}\)
\begin{table}
\begin{tabular}{c c c c c c c c c c c c c} \hline \hline \multicolumn{1}{c}{**Untargeted Attacks**} & \multicolumn{1}{c}{\(\mathbf{\mathcal{C}_{1}}\)} & \(\mathbf{\mathcal{C}_{2}}\) & \(\mathbf{\mathcal{C}_{3}}\) & \(\mathbf{\mathcal{C}_{4}}\) & \(\mathbf{\mathcal{C}_{5}}\) & \(\mathbf{\mathcal{C}_{6}}\) & \(\mathbf{\mathcal{C}_{7}}\) & \(\mathbf{\mathcal{C}_{8}}\) & \(\mathbf{\mathcal{C}_{9}}\) & \(\mathbf{\mathcal{C}_{10}}\) \\ \hline \multirow{5}{*}{EA} & \(\uparrow c_{afri}\
eq c_{a}\) & 2 & 3 & 1 & 11 & 2 & 7 & 5 & 0 & 31 & 28 & 90 \\  & \(c_{afri}=c_{Def}\) & 2 & 3 & 1 & 11 & 2 & 7 & 5 & 0 & 31 & 28 & \\  & \(c_{afri}=c_{ef}\) & 93 & 92 & 93 & 83 & 87 & 88 & 87 & 86 & 59 & 62 & \\  & \(\uparrow\) SR & 2.2 & 3.2 & 1.1 & 11.7 & 2.2 & 7.4 & 5.4 & 0.0 & 34.4 & 31.1 & 9.9 \\ \hline \multirow{5}{*}{AdvGAN} & \(\uparrow c_{afri}\
eq c_{a}\) & 4 & 8 & 4 & 4 & 8 & 7 & 2 & 6 & 18 & 22 & 83 \\  & \(c_{afri}=c_{Def}\) & 4 & 8 & 4 & 4 & 8 & 7 & 2 & 6 & 18 & 22 & \\  & \(\downarrow c_{afri}=c_{a}\) & 92 & 86 & 89 & 77 & 81 & 85 & 84 & 82 & 60 & 57 & \\  & \(\uparrow\) SR & 4.2 & 8.5 & 4.3 & 4.9 & 9.0 & 7.6 & 2.3 & 6.8 & 23.1 & 27.8 & 9.9 \\ \hline \multirow{5}{*}{SimBA} & \(\uparrow c_{afri}\
eq c_{a}\) & 25 & 23 & 22 & 24 & 18 & 25 & 32 & 30 & 31 & 36 & 266 \\  & \(c_{afri}=c_{Def}\) & 25 & 23 & 22 & 24 & 18 & 25 & 32 & 30 & 31 & 36 & \\  & \(c_{afri}=c_{ef}\) & 66 & 71 & 70 & 67 & 67 & 65 & 60 & 48 & 56 & 51 & \\  & \(\uparrow\) SR & 27.5 & 24.5 & 23.9 & 26.4 & 21.2 & 27.8 & 34.8 & 38.5 & 35.6 & 41.4 & 30.1 \\ \hline \multirow{5}{*}{FCSM} & \(\uparrow c_{afri}\
eq c_{a}\) & 77 & 60 & 64 & 63 & 49 & 84 & 79 & 75 & 86 & 87 & 724 \\  & \(\downarrow c_{afri}=c_{Def}\) & 77 & 59 & 62 & 59 & 49 & 83 & 74 & 75 & 86 & 86 & \\  & \(\downarrow c_{afri}=c_{a}\) & 1 & 3 & 3 & 1 & 1 & 0 & 1 & 0 & 0 & 0 & \\  & \(\uparrow\) SR & 98.7 & 95.2 & 95.5 & 98.4 & 98.0 & 100.0 & 98.8 & 100.0 & 100.0 & 100.0 & 98.5 \\ \hline \multirow{5}{*}{BIM} & \(\uparrow c_{afri}\
eq c_{a}\) & 95 & 97 & 96 & 95 & 88 & 96 & 93 & 93 & 92 & 92 & 937 \\  & \(c_{afri}=c_{Def}\) & 95 & 96 & 96 & 92 & 87 & 96 & 93 & 93 & 92 & 92 & \\  & \(\downarrow c_{afri}=c_{a}\) & 1 & 1 & 0 & 1 & 0 & 0 & 0 & 1 & 0 & 0 & \\  & \(\uparrow\) SR & 99.0 & 99.0 & 100.0 & 99.0 & 100.0 & 100.0 & 100.0 & 98.9 & 100.0 & 100.0 & 99.6 \\ \hline \multirow{5}{*}{PGD Inf} & \(\uparrow c_{afri}\
eq c_{a}\) & 97 & 99 & 98 & 97 & 93 & 97 & 95 & 95 & 92 & 93 & 956 \\  & \(c_{afri}=c_{def}\) & 97 & 99 & 98 & 97 & 92 & 97 & 95 & 95 & 92 & 93 & \\  & \(\downarrow c_{afri}=c_{a}\) & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & \\  & SR & 100 & 100 & 100 & 100 & 100 & 100 & 100 & 100 & 100 & 100.0 & 100.0 \\ \hline \multirow{5}{*}{PGD L2} & \(\uparrow c_{afri}\
eq c_{a}\) & 96 & 98 & 97 & 96 & 92 & 96 & 93 & 89 & 91 & 92 & 940 \\  & \(c_{afri}=c_{Ref}\) & 96 & 98 & 97 & 96 & 92 & 96 & 93 & 89 & 90 & 92 & \\  & \(\downarrow c_{afri}=c_{a}\) & 1 & 1 & 0 & 1 & 2 & 0 & 0 & 0 & 0 & 0 & 0 \\  & \(\uparrow\) SR & 99.0 & 99.0 & 100.0 & 99.0 & 97.9 & 100.0 & 100.0 & 100.0 & 100.0 & 100.0 & 99.5 \\ \hline \multirow{5}{*}{\(\uparrow\) Average SR} & 61.5 & 61.3 & 60.7 & 62.8 & 61.2 & 63.3 & 63.0 & 63.5 & 70.5 & 71.5 & 63.9 \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Performance of the Noise blowing-up technique on adversarial images generated with untargeted attacks against 10 CNNs. The symbol \(\uparrow\) (resp. \(\downarrow\)) indicates the higher (resp. the lower) the value the better.