## 5 Experimental Results of the Noise Blowing-Up Method
### Interpretation of the Results of Phase 2  
In the **targeted scenario**, the noise blowing-up strategy achieved an overall average success rate (overall attacks and CNNs) of 74.7% (see Table 7). Notably, the strategy performed close to perfection with PGD Inf, achieving an average success rate of 99.2% (and minimal loss of 0.009). The strategy performed also very well with PGD L2, EA, and BIM, with average success rates of 93.2%, 91.5%, and 88.6%, respectively. In contrast, the strategy performed poorly with AdvGAN, achieving a success rate oscillating between 0% (for 8 CNNs) and 8.7%, leading to an average success rate of 0.9%. The reason for the success of the noise blowing-up strategy for PGD Inf, PGD L2, EA and BIM, and its failure for AdvGAN is essentially due to the behavior, for these attacks, of the average label values of the dominant categories obtained in Table 5, hence is due to a phenomenon occurring _before_ the noise blowing-up process _per se_. Indeed, these values are very high for the white-box attacks PGD Inf (0.986), PGD L2 (0.943), and BIM (0.901), and are quite high for EA (0.551). However, this value is very low for AdvGAN (0.255). \begin{table}
\begin{tabular}{c c c c c c c c c c c} \hline \hline _atk_ & **Images** & **Step 1** & **Step 2** & **Step 3** & **Step 4** & **Step 5** & **Step 6** & **Step 7** & **Step 8** & **Overhead** & **\%** \\ \hline EA & \(\mathcal{A}_{1}^{10}\) & 0.144 & 0.047 & 848.7 & \(3\times 10^{-4}\) & 0.053 & 0.101 & 0.363 & 0.048 & 0.757 & 0.89 \\  & \(\mathcal{A}_{2}^{1}\) & 0.010 & 0.048 & 443.2 & \(3\times 10^{-4}\) & 0.003 & 0.002 & 0.011 & 0.047 & 0.122 & 0.28 \\ \hline FGSM & \(\mathcal{A}_{1}^{10}\) & 0.148 & 0.050 & 59.2 & \(2\times 10^{-4}\) & 0.045 & 0.103 & 0.360 & 0.049 & 0.755 & 12.75 \\  & \(\mathcal{A}_{2}^{1}\) & 0.009 & 0.049 & 58.1 & \(2\times 10^{-4}\) & 0.003 & 0.002 & 0.011 & 0.046 & 0.120 & 2.06 \\ \hline BIM & \(\mathcal{A}_{1}^{10}\) & 0.143 & 0.049 & 83.8 & \(2\times 10^{-4}\) & 0.045 & 0.103 & 0.356 & 0.049 & 0.744 & 8.88 \\  & \(\mathcal{A}_{2}^{1}\) & 0.009 & 0.047 & 97.5 & \(2\times 10^{-4}\) & 0.003 & 0.002 & 0.010 & 0.046 & 0.118 & 1.22 \\ \hline PGD Inf & \(\mathcal{A}_{1}^{10}\) & 0.143 & 0.048 & 90.7 & \(2\times 10^{-4}\) & 0.045 & 0.102 & 0.357 & 0.049 & 0.744 & 8.21 \\  & \(\mathcal{A}_{2}^{1}\) & 0.009 & 0.051 & 88.3 & \(2\times 10^{-4}\) & 0.003 & 0.002 & 0.010 & 0.046 & 0.122 & 1.38 \\ \hline PGD L2 & \(\mathcal{A}_{1}^{10}\) & 0.141 & 0.048 & 104.2 & \(2\times 10^{-4}\) & 0.044 & 0.101 & 0.350 & 0.047 & 0.732 & 7.02 \\  & \(\mathcal{A}_{2}^{2}\) & 0.009 & 0.048 & 106.3 & \(2\times 10^{-4}\) & 0.003 & 0.002 & 0.010 & 0.046 & 0.118 & 1.11 \\ \hline AVG & \(\mathcal{A}_{1}^{10}\) & 0.144 & 0.048 & & \(2\times 10^{-4}\) & 0.047 & 0.102 & 0.357 & 0.048 & 0.746 & \\  & \(\mathcal{A}_{2}^{1}\) & 0.009 & 0.049 & & \(2\times 10^{-4}\) & 0.003 & 0.002 & 0.010 & 0.046 & 0.120 & \\ \hline \hline \end{tabular}
\end{table} 
Table 11: In the target scenario, for each considered attack _atk_, execution time (in seconds, averaged over the 10 CNNs) of each step of Scheme (11) for the generation of HR adversarial images for the HR clean images \(\mathcal{A}_{1}^{10}\) and \(\mathcal{A}_{2}^{1}\). The Overhead column provides the cumulative time of all steps except Step 3. The % column displays the relative per mille additional time of the Overhead as compared to the time required by _atk_ performed in Step 3.