## 6 Revisiting the Failed Cases with \(\Delta_{C}\)
### Outcome of Revisiting the Failed Cases  
One constructs the graph of the evolution of the success rate (\(y\)-_axis_, in %) of the noise blowing-up strategy performed for the considered attack for the untargeted scenario according to step-wise increasing values (\(x\)-axis) set to \(\Delta_{C}\). Figure 4 for \(atk=\) EA (untargeted scenario), Figure 5 for \(atk=\) AdvGAN (untargeted scenario) and Figure 6 for \(atk=\) AdvGAN (targeted scenario) picture this evolution for an example, namely \(\mathcal{C}_{4}\)--MobileNet (a), on average over the 10 CNNs (b), and per CNN for all considered images (c). UT (resp. T) in (a) and (b) of Figures 4 and 5 (resp. of Figure 6) recalls the \"original\" success rate achieved by the noise blowing-up method in creating adversarial images **without** putting extra conditions on \(\Delta_{C}\) (see Table 8, resp. Table 7). The values at the top of the Figures are the number of images obtained after Phase 1, as \(\Delta_{C}\) increases. Detailed reports for each CNN can be found in the Appendix C, Figures 11-13. In the untargeted scenario for \(atk=\) EA, the approach adopted for the revisited failed cases turns out to be overwhelmingly successful, and this in a uniform way over the 10 CNNs. The overall number of considered images drops only by 0.6%, namely from 920 to 914 (in the example of \(\mathcal{C}_{4}\), this drop is of one image only), while the success rate drastically increases from an original 9.9% to 98.7%. In the example of \(\mathcal{C}_{4}\), the success rate increases from 11.7% to 98.9%; a success rate of 100% is even achieved for six out of 10 CNNs, even for moderate values of \(\Delta_{C}\). Figure 4: Performance of the noise blowing-up method for EA in the untargeted scenario with the increased strength of adversarial images: (**a**) specifically for \(\mathcal{C}_{4}\)**(b**) averaged across 10 CNNs, and (**c**) overall report for all CNNs. In (**a**,**b**), \(\Delta_{C}\) values are displayed at the bottom, and the resulting number of used images is at the top. Figure 5: Performance of the noise blowing-up method for AdvGAN in the untargeted scenario with the increased strength of adversarial images: (**a**) specifically for \(\mathcal{C}_{4}\), (**b**) averaged across 10 CNNs, and (**c**) overall report for all CNNs. In (**a**,**b**), \(\Delta_{\mathcal{C}}\) values are displayed at the bottom, and the resulting number of used images is at the top. Figure 6: Performance of the noise blowing-up method for AdvGAN in the target scenario with the increased strength of adversarial images: (**a**) specifically for \(\mathcal{C}_{4}\), (**b**) averaged across 10 CNNs, and (**c**) overall report for all CNNs. In (**a**,**b**), \(\Delta_{\mathcal{C}}\) values are displayed at the bottom, and the resulting number of used images is at the top. In the untargeted scenario for \(atk=\text{AdvGAN}\), the approach is also successful, but to a lesser extent, and with variations among the CNNs. The overall number of considered images drops by 43%, namely from 876 to 500 images (in the example of \(\mathcal{C}_{4}\), this drop amounts to 22 images, hence almost 27% less images), while the success rate increases from an original 9.9% to 73.1% (in the example of \(\mathcal{C}_{4}\), the success rate increases from 4.9% to 71.2%). Apart from \(\mathcal{C}_{2}\) and \(\mathcal{C}_{5}\), where the success rate of the revisited method achieves at most 50% and 25.8%, all CNNs are reasonably well deceived by the method; the success rate achieves even 100% for two of them, and this for moderate values of \(\Delta_{\mathcal{C}}\). In the targeted scenario, for \(atk=\text{AdvGAN}\), the approach also proves useful, but to a lesser extent as above, and with larger variations among the CNNs.