## 6 Revisiting the Failed Cases with \(\Delta_{C}\)
### Outcome of Revisiting the Failed Cases
The overall number of considered images drops by 21%, namely from 758 to 594 images (from 88 to 72 images, hence almost 18% less images for \(\mathcal{C}_{4}\)), while the success rate increases from an original 0.3% to 50.8% (in the example of \(\mathcal{C}_{4}\), the success rate increases from 0% to 34.7%). It is worthwhile noting that the method works to perfection with a success rate reaching 100% for two CNNs (\(\mathcal{C}_{9}\) and \(\mathcal{C}_{10}\)), even with a moderate \(\Delta_{\mathcal{C}}\) value. Table 13 summarizes the outcomes of the numerical experiments when \(\Delta_{\mathcal{C}}\) is set to the demanding value 0.55. As a consequence, it is advisable to set (for Phase 1, Step 3) \(\tilde{\tau}_{c_{\mathit{ref}}}\) to 0.78 for \(EA_{\mathit{unlarge}}\), to 0.76 for \(AdvGAN_{\mathit{large}}\), and to 0.79 for \(AdvGAN_{\mathit{unlarge}}\) to be on the safe side (these values exceed the maxima referred to in Table 13). Finally, experiments show that the visual quality of the HR adversarial images obtained by the revised method remains outstanding. We illustrate this statement in Figure 7 on an example, where \(\Delta_{\mathcal{C}}\) is set to 0.55 (the highest and most demanding value considered in the present study), and the CNN is \(\mathcal{C}_{4}\). In Figure 7, (a) represents the HR clean image \(\mathcal{A}_{2}^{3}\) classified by \(\mathcal{C}_{4}\) as belonging to the \"acorn\" category with corresponding label value 0.90, (b) the adversarial image created by the strategy applied to the EA attack in the untargeted scenario (classified as \"snail\" with label value 0.61), (c) the adversarial image created by the strategy with [PERSON] in the untargeted scenario (classified as \"dung beetle\" with label value 0.55), and (d) the adversarial image created by the strategy with [PERSON] in the targeted scenario (classified as \"rhinoceros beetle\" with label value 0.43). The images speak for themselves as far as visual quality is concerned. \begin{table}
\begin{tabular}{c c c c c c c c c c} \hline \hline  & \multicolumn{3}{c}{\(EA_{\mathit{unlarge}}\)} & \multicolumn{3}{c}{\(AdvGAN_{\mathit{large}}\)} & \multicolumn{3}{c}{\(AdvGAN_{\mathit{unlarge}}\)} \\ \hline  & **Min** & **Max** & **Mean** & **Min** & **Max** & **Mean** & **Min** & **Max** & **Mean** \\ \hline \(\mathcal{C}_{1}\) & 0.587 & 0.779 & 0.723 & 0.575 & 0.731 & 0.636 & 0.588 & 0.770 & 0.690 \\ \(\mathcal{C}_{2}\) & 0.593 & 0.778 & 0.725 & 0.583 & 0.689 & 0.633 & 0.619 & 0.766 & 0.710 \\ \(\mathcal{C}_{3}\) & 0.597 & 0.777 & 0.720 & 0.613 & 0.757 & 0.662 & 0.594 & 0.772 & 0.701 \\ \(\mathcal{C}_{4}\) & 0.572 & 0.771 & 0.657 & 0.571 & 0.688 & 0.624 & 0.581 & 0.771 & 0.654 \\ \(\mathcal{C}_{5}\) & 0.564 & 0.775 & 0.653 & 0.572 & 0.739 & 0.633 & 0.582 & 0.748 & 0.646 \\ \(\mathcal{C}_{6}\) & 0.610 & 0.780 & 0.725 & 0.587 & 0.741 & 0.655 & 0.581 & 0.778 & 0.691 \\ \(\mathcal{C}_{7}\) & 0.587 & 0.778 & 0.725 & 0.604 & 0.749 & 0.655 & 0.610 & 0.767 & 0.691 \\ \(\mathcal{C}_{8}\) & 0.603 & 0.777 & 0.724 & 0.586 & 0.756 & 0.654 & 0.606 & 0.788 & 0.699 \\ \(\mathcal{C}_{9}\) & 0.593 & 0.778 & 0.709 & 0.584 & 0.733 & 0.633 & 0.594 & 0.775 & 0.674 \\ \(\mathcal{C}_{10}\) & 0.593 & 0.779 & 0.708 & 0.584 & 0.749 & 0.632 & 0.605 & 0.775 & 0.677 \\ \hline Avg & **0.590** & **0.777** & **0.707** & **0.586** & **0.733** & **0.641** & **0.596** & **0.771** & **0.683** \\ \hline \hline \end{tabular}
\end{table} 
Table 13: Minimum, maximum, and mean of the label values \(\tilde{\tau}_{c_{\mathit{ref}}}\) of adversarial images in the \(\mathcal{R}\) domain (Phase 1, Step 3) when \(\Delta_{\mathcal{C}}\) is set to 0.55 per CNN.