## 5 Experimental Results of the Noise Blowing-Up Method
### Phase 2: Running \(atk_{\mathcal{H},\mathcal{L}}^{scenario}\)  
For the relevant adversarial images kept from Table 5, one proceeds with the remaining steps of Scheme (11) with the extraction of the adversarial noise in the \(\mathcal{R}\) domain, its blowing-up to the \(\mathcal{H}\) domain, its addition to the clean HR corresponding image, and the classification by the CNN of the resulting tentative adversarial image. The **speed of the noise blowing-up method** is directly impacted by the size of the clean high-resolution image (as pointed out in [31]). Therefore, representative HR clean images of large size and small sizes are required to assess the additional computational cost (both in absolute and relative terms) involved by the noise blowing-up method. To ensure a fair comparison across various attacks and CNNs, we selected for each scenario (targeted or untargeted) HR clean images where all attacks successfully generated HR adversarial images against 10 CNNs. This led to the images referred to in Table 6 (the Table indicates their respective sizes \(h\times w\)). The performance of the noise blowing-up method is summarized in Table 7 Please revise all mentions according to requested style and ensure all tables are mentioned in numerical order. for adversarial images generated by \(atk_{\mathcal{H},\mathcal{L}}^{targeted}\), and in Table 8 for those generated by \(atk_{\mathcal{H},\mathcal{L}}^{untargeted}\) for each CNN and attack (except \(SimBA_{\mathcal{H},\mathcal{L}}^{targeted}\) and \(FGSM_{\mathcal{H},\mathcal{L}}^{targeted}\) for reasons given in Section 5.2). The adversarial images in \(\mathcal{R}\) used for these experiments are those referred to in Table 5.  
For each relevant attack and CNN, the measures of a series of outcomes are given in Tables 7 and 8. Regarding **targeted attacks** (the five attacks EA, AdvGAN, BIM, PGD Inf, and PGD L2 are considered) as summarized in Table 7, the row \(c_{aft}=c_{bef}\) (and \(=c_{t}\)) gives the number of adversarial images for which the noise blowing-up strategy succeeded. The row SR gives the resulting success rate in % (For example, with EA and \(\mathcal{L}_{1}\), SR \(=\frac{81}{89}=91\%\)). The row \(c_{aft}\
eq c_{bef}\) reports the number of adversarial images for which the noise blowing-up strategy failed. The row \(c_{aft}=c_{a}\) reports the number of images, among those that failed, that are classified back to \(c_{a}\). The row \(\mathcal{L}_{\mathcal{C}}\) gives the mean value of the loss function (see Section 3.2) for the adversarial images that succeeded, namely those referred to in the row \(c_{aft}=c_{bef}\). Relevant sums or average values are given in the last column. Regarding **untargeted attacks** (the seven attacks are considered) as summarized in Table 8, the row \(c_{aft}\
eq c_{a}\) gives the number of adversarial images for which the noise blowing-up strategy succeeded, and the row SR gives the resulting success rate. The row \(c_{aft}=c_{bef}\) reports the number of images, among those that succeeded, that are classified in the same category as the adversarial image obtained in Phase 1. The row \(c_{aft}=c_{a}\) reports the number of images for which the strategy failed. Relevant sums or average values are given in the last column. To assess the **visual imperceptibility of adversarial images compared to clean images**, we utilize \(L_{p}\)-norms and FID values (see Section 3.2). The average (Avg) and standard deviation (StDev) values of the \(L_{p}\)-norms and FID values, across all CNNs for each attack, \begin{table}
\begin{tabular}{c c c} \hline \hline
**Attacks** & **Targeted** & **Untargeted** \\
**EA, FGSM, BIM, PGD Inf, PGD L2** & **FGSM, BIM, PGD Inf, PGD L2** \\ \hline \multirow{2}{*}{images (\(h\times w\))} & \(\mathcal{A}_{1}^{10}\) (\(2448\times 3264\)) & \(\mathcal{A}_{6}^{9}\) (\(1536\times 2048\)) \\  & \(\mathcal{A}_{2}^{1}\) (\(374\times 500\)) & \(\mathcal{A}_{8}^{4}\) (\(253\times 380\)) \\ \hline \hline \end{tabular}
\end{table}