## 5 Experimental Results of the Noise Blowing-Up Method
### Interpretation of the Results of Phase 2
\begin{table}
\begin{tabular}{c c c c c c c c c c c} \hline \hline  & **Images** & **Step 1** & **Step 2** & **Step 3** & **Step 4** & **Step 5** & **Step 6** & **Step 7** & **Step 8** & **Overhead** & **\%** \\ \hline FGSM & \(\mathcal{A}_{2}^{9}\) & 0.056 & 0.042 & 66.3 & \(2\times 10^{-4}\) & 0.021 & 0.037 & 0.136 & 0.042 & 0.334 & 5.04 \\  & \(\mathcal{A}_{8}^{4}\) & 0.007 & 0.045 & 67.2 & \(2\times 10^{-4}\) & 0.002 & 0.001 & 0.005 & 0.042 & 0.103 & 1.53 \\ \hline BIM & \(\mathcal{A}_{2}^{2}\) & 0.055 & 0.042 & 78.9 & \(2\times 10^{-4}\) & 0.021 & 0.038 & 0.135 & 0.042 & 0.333 & 4.22 \\  & \(\mathcal{A}_{8}^{4}\) & 0.007 & 0.043 & 79.1 & \(2\times 10^{-4}\) & 0.002 & 0.001 & 0.005 & 0.042 & 0.101 & 1.27 \\ \hline PGD Inf & \(\mathcal{A}_{2}^{9}\) & 0.056 & 0.043 & 80.9 & \(2\times 10^{-4}\) & 0.020 & 0.038 & 0.137 & 0.042 & 0.336 & 4.15 \\  & \(\mathcal{A}_{8}^{4}\) & 0.007 & 0.043 & 81.8 & \(2\times 10^{-4}\) & 0.002 & 0.001 & 0.005 & 0.042 & 0.100 & 1.23 \\ \hline PGD L2 & \(\mathcal{A}_{2}^{9}\) & 0.055 & 0.043 & 80.9 & \(2\times 10^{-4}\) & 0.021 & 0.038 & 0.137 & 0.042 & 0.337 & 4.17 \\  & \(\mathcal{A}_{8}^{4}\) & 0.007 & 0.045 & 81.5 & \(2\times 10^{-4}\) & 0.002 & 0.001 & 0.005 & 0.040 & 0.101 & 1.24 \\ \hline AVG & \(\mathcal{A}_{6}^{9}\) & 0.055 & 0.043 & & \(2\times 10^{-4}\) & 0.021 & 0.038 & 0.136 & 0.042 & **0.335** & \\  & \(\mathcal{A}_{8}^{4}\) & 0.007 & 0.044 & & \(2\times 10^{-4}\) & 0.002 & 0.001 & 0.005 & 0.041 & **0.101** & \\ \hline \hline \end{tabular}
\end{table} 
Table 12: In the untargeted scenario, for each considered attack _atk_, execution time (in seconds, averaged over the 10 CNNs) of each step of Scheme (11) for the generation of HR adversarial images for the HR clean images \(\mathcal{A}_{6}^{9}\) and \(\mathcal{A}_{8}^{4}\). The Overhead column provides the cumulative time of all steps except Step 3. The % column displays the relative per mille additional time of the Overhead as compared to the time required by _atk_ performed in Step 3. The adversarial noises, obtained after Phase 1 (in the \(\mathcal{R}\) domain) by all attacks except AdvGAN, are particularly robust, and \"survive\" the Phase 2 treatment: The noise blowing-up process did not significantly reduce their adversarial properties legacy, and the derived adversarial images, obtained after the noise blowing-up process, remained in the target category. The situation differs for AdvGAN: After Phase 1, the target category is only modestly dominating other categories, and one (or more) other categories achieve only slightly weaker label values than the dominating target category. Consequently, the adversarial noise becomes highly susceptible to even minor perturbations, with the effect that these perturbations can easily cause transitions between categories. In the **untargeted scenario**, the noise blowing-up strategy achieved an overall average success rate (overall attacks and CNNs) of 63.9% (see Table 8). The strategy performed perfectly or close to perfection with all white-box attacks, namely PGD Inf (average success rate of 100%), BIM (99.6%), PGD L2 (99.5%) and FGSM (98.5%). _A contrario_, the strategy performed weakly or even poorly for all black-box attacks, namely SimBA (30.1%), AdvGAN (9.9%), and EA (9.9%). The reason for these differences in the successes of the strategy according to the considered attacks is the same as seen before in the target scenario: the behavior of the average label values of the dominating category obtained in Table 5 (hence, in this case too, _before_ the noise blowing-up process). Indeed, these values are very high or fairly high for PGD Inf (0.987), BIM (0.958), PGD L2 (0.966), and FGSM (0.522). However, they are much lower for EA (0.359), SimBA (0.352), and AdvGAN (0.150). The adversarial noises, obtained after Phase 1 by all white-box attacks, are particularly robust, and those obtained by all black-box attacks are less resilient.