## 8 Conclusions  
In this extensive study, we exposed in detail the noise blowing-up strategy to create high-quality high-resolution images adversarial against convolutional neural networks, and indistinguishable from the original clean images. This strategy is designed to apply to any attack (black-box or white-box), to any scenario (targeted or untargeted scenario), to any CNN, and to any clean image. We performed an extensive experimental study on 10 state-of-the-art and diverse CNNs, with 100 high-resolution clean images, three black-box (EA, AdvGAN, SimBA), and four white-box (FGSM, BIM, PGD Inf, PGD L2) attacks, applied in the target and the untarget scenario whenever possible. This led to the construction of 4110 adversarial images for the target scenario and 3996 adversarial images for the untarget scenario. Therefore, the noise blowing-up method achieved an overall average success rate of 74.7% in the target scenario, and of 63.9% in the untarget scenario; the strategy performing perfectly or close to perfection (with a success rate of 100% or close to it) for many attacks. We then focused on the failed cases. We showed that a minor additional requirement in one step of the strategy led to a substantial success rate increase (e.g., from circa 9.9% to 98.7% in the untarget scenario for the EA attack). All along, we showed that the additional time required to perform our noise blowing-up strategy is negligible as compared to the actual cost of the underlying attack on which the strategy applies. Finally, we compared our noise blowing-up method to another generic method, namely the lifting method. We showed that the visual quality and indistinguishability of the adversarial images obtained by our noise blowing-up strategy substantially outperform those of the adversarial images obtained by the lifting method. We also showed that applying our noise blowing-up strategy substantially corrects some visual blurriness artifacts caused natively by interpolation resizing functions. Figure 10: Visual comparison in the \(\mathcal{H}\) domain of (**a**) the clean image \(\mathcal{A}_{3}^{\text{tr}}\), (**b**) its non-adversarial resized version, the adversarial image obtained with \(\text{EA}^{\text{target},\mathcal{C}}\) for \(\mathcal{C}=\text{VGG-16}\), (**c**) by the lifting method of [29, 30], and (**d**) by the noise blowing-up method. Both non-adversarial images are classified as “hippopotamus”, (**a**) with label value 0.99 and (**b**) with label value 0.99. Both HR adversarial images are classified as “traffic”, (**c**) with label value 0.51, and (**d**) with label value 0.50. Clearly, the noise blowing-up strategy, which essentially amounts to the addition to the clean high-resolution image of one layer of \"substantial\" adversarial noise, blown-up from \(\mathcal{R}\) to \(\mathcal{H}\), is subject to a series of refinements and variants. For instance, one may instead consider adding to the clean image several \"thin\" layers of \"moderate\" blown-up adversarial noise. This would present at least two advantages. Firstly, one can parallelize this process. Secondly, depending on how adding different layers of adversarial noise impacts the overall \(\tau_{c_{eff}}\)-value, one could consider relaxing the expectations on the \(\tilde{\tau}_{c_{eff}}\) value for each run of the attack in the \(\mathcal{R}\) domain, and still meet \(\tau_{c_{eff}}\) and \(\Delta_{C}\) preset thresholds by adding up wisely the successive layers of noise. Both advantages may lead to a substantial speed-up of the process, and potentially to an increased visual quality. One could also consider applying the strategy to the flat scenario, where all \(\ell\) label values are almost equidistributed, henceforth the CNN considers that all categories are almost equally likely (even this variant admits variants, e.g., where one specifies a number \(2\leq x\leq\ell\) of dominating categories for which the attack would create an appropriate flatness).