## 2 CNNs and Attack Scenarios
### Assessment of the Human Perception of Distinct Images  
Given two images \(\mathcal{A}\) and \(\mathcal{B}\) of the same size \(h\times w\) (belonging or not to the \(\mathcal{R}\) domain), there are different ways to assess numerically the human perception of the difference between them, as well as the actual \"weight\" of this difference. In the present study, this assessment is performed mainly by computing the (normalized) values of \(L_{p}(\mathcal{A},\mathcal{B})\) for \(p=0,1,2\), or \(\infty\) and the Frechet Inception Distance (FID).  
Introduced in [37], FID originally served as a metric to evaluate the performance of GANs by assessing the similarity of generated images. FID is one of the recent tools for assessing the visual quality of adversarial images and it aligns closely with human judgment (see [38; 39; 40]). On the other hand, [41; 42] provide an assessment of \(L_{p}\)-norms as a measure of perceptual distance between images.  
In a nutshell, for an image \(\mathcal{I}\) of size \(h\times w\), the integer  
\[0\leq p_{i,j,\alpha}(\mathcal{I})\leq 255\]  
denotes the value of the pixel positioned in the \(i\)th-row, \(j\)th-column, of the image \(\mathcal{I}\) for the channel \(\alpha\in\{R,G,B\}\) (\(R=\text{Red}\), \(G=\text{Green}\), \(B=\text{Blue}\)). Then,  
* \(L_{0}^{norm}(\mathcal{A},\mathcal{B})=\frac{1}{3 hw}\#\{i,j,\alpha\;;\;p_{i,j, \alpha}(\mathcal{A})\
eq p_{i,j,\alpha}(\mathcal{B})\}\),
* \(L_{1}^{norm}(\mathcal{A},\mathcal{B})=\frac{1}{2^{3}hw}\sum_{i,j,\alpha}|p_{i,j,\alpha}(\mathcal{A})-p_{i,j,\alpha}(\mathcal{B})|\),
* \(L_{2}^{norm}(\mathcal{A},\mathcal{B})=\frac{1}{2^{3}hw}\sum_{i,j,\alpha}|p_{ i,j,\alpha}(\mathcal{A})-p_{i,j,\alpha}(\mathcal{B})|^{2}\),
* \(L_{\infty}(\mathcal{A},\mathcal{B})=\text{Max}_{i,j,\alpha}|p_{i,j,\alpha}( \mathcal{A})-p_{i,j,\alpha}(\mathcal{B})|\)  
where \(1\leq i\leq h,1\leq j\leq w\), and \(\alpha\in\{R,G,B\}\). These quantities satisfy the inequalities:  
\[0\leq L_{0}^{norm}(\mathcal{A},\mathcal{B}),L_{1}^{norm}(\mathcal{A},\mathcal{ B}),L_{2}^{norm}(\mathcal{A},\mathcal{B})\leq 1,\text{ and }0\leq L_{\infty}(\mathcal{A}, \mathcal{B})\leq 256.\]  
The closer their values are to 0, the closer are the images \(\mathcal{A},\mathcal{B}\) to each other.  
To effectively capture the degree of disturbance, and therefore to provide a reliable measure of the level of disruption, FID quantifies the separation between clean and disturbed images based on extracting features from images that are provided by the Inception-v3 network [43]. Activations from one of the intermediate layers of the Inception v3 model are used as feature representations for each image. FID assesses the similarity between two probability distributions in a metric space, via the formula:  
* \(\text{FID}(\mathcal{A},\mathcal{B})=\|\mu_{\mathcal{A}}-\mu_{\mathcal{B}}\|^ {2}+\text{Tr}(M_{\mathcal{A}}+M_{\mathcal{B}}-2\cdot\sqrt{M_{\mathcal{A}} \cdot M_{\mathcal{B}}})\)  
where, \(\mu_{\mathcal{A}}\) and \(\mu_{\mathcal{B}}\) denote feature-wise mean vectors for the images \(\mathcal{A}\) and \(\mathcal{B}\), respectively, reflecting average features observed across the images. \(M_{\mathcal{A}}\) and \(M_{\mathcal{B}}\) represent covariance matrices for the feature vectors (covariance matrices offer insights into how features in the vectors co-vary with each other). The quantity \(\|\mu_{\mathcal{A}}-\mu_{\mathcal{B}}\|^{2}\) captures the squared difference in mean vectors (highlighting disparities in these average features), and the trace quantity assesses dissimilarities between the covariance matrices. In the end, FID quantifies how similar the distribution of feature vectors in the \(\mathcal{A}\) is to that in the \(\mathcal{B}\). The lower the FID value, the more similar the images \(\mathcal{A}\) and \(\mathcal{B}\).