## 7 Comparison of the Lifting Method and of the Noise Blowing-Up Method
### Implementation and Outcomes
These observations are also sustained numerically by Table 15: \(L_{p,\mathcal{H}}^{norm,clean}\) and \(L_{p,\mathcal{H}}^{norm,adv,lift}\), as well as \(\text{FID}_{\mathcal{H}}^{clean}\) and \(\text{FID}_{\mathcal{H}}^{adv,lift}\) are close one to the other, while \(L_{p,\mathcal{H}}^{norm,adv,noise}\) and \(\text{FID}_{\mathcal{H}}^{adv,noise}\) achieve much smaller values than their above counterparts. In particular, we see and measure in these examples, that the noise blowing-up method largely compensates for the negative visual impact of the resiziz \begin{table}
\begin{tabular}{c c c c c} \hline \hline  & & \(\mathbf{\mathcal{A}}_{\mathbf{i}}^{\text{hr}}\) & \(\mathbf{\mathcal{A}}_{\mathbf{2}}^{\text{hr}}\) & \(\mathbf{\mathcal{A}}_{\mathbf{3}}^{\text{hr}}\) \\ \hline \multirow{3}{*}{\(L_{0}\)} & \(L_{0,\mathcal{H}}^{norm,clean}\) & 0.963 & 0.938 & 0.999 \\  & \(L_{0,\mathcal{H}}^{norm,adv,lift}\) & 0.973 & 0.970 & 0.969 \\  & \(L_{0,\mathcal{H}}^{norm,adv,noise}\) & 0.920 & 0.960 & 0.961 \\ \hline \multirow{3}{*}{\(L_{1}\)} & \(L_{1,\mathcal{H}}^{norm,clean}\) & 0.071 & 0.037 & 0.029 \\  & \(L_{1,\mathcal{H}}^{norm,adv,lift}\) & 0.075 & 0.049 & 0.049 \\  & \(L_{1,\mathcal{H}}^{norm,adv,noise}\) & 0.021 & 0.028 & 0.032 \\ \hline \multirow{3}{*}{\(L_{2}\)} & \(L_{2,\mathcal{H}}^{norm,clean}\) & \(6\times 10^{-5}\) & \(2\times 10^{-5}\) & \(2\times 10^{-5}\) \\  & \(L_{2,\mathcal{H}}^{norm,adv,lift}\) & \(6\times 10^{-5}\) & \(2\times 10^{-5}\) & \(3\times 10^{-5}\) \\  & \(L_{2,\mathcal{H}}^{norm,adv,noise}\) & \(2\times 10^{-5}\) & \(1\times 10^{-5}\) & \(2\times 10^{-5}\) \\ \hline \multirow{3}{*}{\(L_{\infty}\)} & \(L_{0,\mathcal{H}}^{norm,clean}\) & 244 & 174 & 191 \\  & \(L_{0,\mathcal{H}}^{norm,adv,lift}\) & 245 & 163 & 198 \\  & \(L_{0,\mathcal{H}}^{norm,adv,noise}\) & 27 & 30 & 58 \\ \hline \multirow{3}{*}{FID} & \(\text{FID}_{\mathcal{H}}^{clean}\) & 180.5 & 45.5 & 50.4 \\  & \(\text{FID}_{\mathcal{H}}^{adv,lift}\) & 221.9 & 44.1 & 64.1 \\ \cline{1-1}  & \(\text{FID}_{\mathcal{H}}^{adv,noise}\) & 55.3 & 34.9 & 21.9 \\ \hline \hline \end{tabular}
\end{table} 
Table 15: Numerical assessment of the visual quality of the different HR images (b), (c), (d) compared to the clean ones (a) of Figures 8–10, as measured by \(L_{p}\) distances and FID values. In other words, the adversarial images displayed by the noise blowing-up method in (d) are visually very close to the original clean images (a), while the adversarial images displayed by the lifting method in (c) are visually very close to the non-adversarial resized images in (b). These experiments strongly speak in favor of our noise blowing-up method, despite the fact that interpolation scaling-up methods \(\lambda\) result in a loss of high-frequency features in the \(\mathcal{H}\) domain (as seen in (b) and (c)). More precisely, our noise blowing-up method essentially avoids (and even corrects, as shows the behavior of by \(L_{p}\) and FID values) this later issue, while the lifting method does not. Figure 8: Visual comparison in the \(\mathcal{H}\) domain of (**a**) the clean image \(\mathcal{A}_{1}^{\text{hr}}\), (**b**) its non-adversarial resized version, the adversarial image obtained with \(\text{EA}^{\text{target},\mathcal{C}}\) for \(\mathcal{C}=\text{VGG-16}\), (**c**) by the lifting method of [29; 30], and (**d**) by the noise blowing-up method. Both non-adversarial images are classified as “comic books”, (**a**) with label value 0.49 and (**b**) with label value 0.45. Both HR adversarial images are classified as “altar”, (**c**) with label value 0.52, and (**d**) with label value 0.41. Figure 9: Visual comparison in the \(\mathcal{H}\) domain of (**a**) the clean image \(\mathcal{A}_{2}^{\text{hr}}\), (**b**) its non-adversarial resized version, the adversarial image obtained with \(\text{EA}^{\text{target},\mathcal{C}}\) for \(\mathcal{C}=\text{VGG-16}\), (**c**) by the lifting method of [29; 30], and (**d**) by the noise blowing-up method.