## 7 Comparison of the Lifting Method and of the Noise Blowing-Up Method
### Implementation and Outcomes  
Regarding implementation issues, we use \((\rho,\lambda)=(\text{Lanczos},\text{Lanczos})\) for both the lifting method of [29,30] and the noise blowing-up method presented here, whenever needed. \begin{table}
\begin{tabular}{c c c c} \hline \hline \(a\) & \(1\) & \(2\) & \(3\) \\ \hline \(\mathcal{A}_{a}^{\text{hr}}\) & & & \\ \hline \(h\times w\) & \(800\times 1280\) & \(1710\times 1740\) & \(1200\times 1600\) \\ \hline \((c_{a},\tau_{a})\) & & & \\ \hline \(c_{t}\) & altar & hamper & trifle \\ \hline \hline \end{tabular}
\end{table} 
Table 14: Three clean HR images \(\mathcal{A}_{a}^{\text{hr}}\), their original size, the classification of VGG-16 as \((c_{a},\tau_{a})\) of their reduced versions \(\rho(\mathcal{A}_{a}^{\text{hr}})\) (with \(\rho=\text{``Lanczos”}\)), and the target category. Figure 7: Sample of HR adversarial images generated by the noise blowing-up strategy for the EA and AdvGAN attacks in the untargeted scenario, and the AdvGAN attack in the targeted scenario against \(\mathcal{C}_{4}=\) MobileNet, with \(\Delta_{\mathcal{C}}\) set to \(0.55\) in the \(\mathcal{R}\) domain. Classification (dominant category and label value) of \(\mathcal{C}_{4}\) are displayed at the bottom. (**a**) Clean image acorr: \(0.90\). (**b**) EA\({}_{untag}\) snail: \(0.61\). (**c**) AdvGAN\({}_{untag}\) dung_beetle: \(0.55\). (**d**) AdvGAN\({}_{targ}\) rhinoceros_beetle: \(0.43\). In terms of the steps described in Section 3.1, note that both strategies coincide up to Step 3 included, and start to differ from Step 4 on. In particular, the attack process (Step 3) in the \(\mathcal{R}\) domain is the same for both strategies. In the present case, one shall apply the EA-based targeted attack in the \(\mathcal{R}\) domain, with the aim to create a 0.55-_strong_ adversarial image. In other words, \(\hat{\tau}_{bef}\geq 0.55\) (with notations consistent with Section 3). This process succeeded for the three examples. Figures 8-10 provide a visual comparison (both globally and on some zoomed area) of a series of images in the \(\mathcal{H}\) domain for \(a=1,2,3\), respectively: (a) the clean image \(\mathcal{A}_{a}^{\text{hr}}\), (b) the non-adversarial resized image \(\lambda\circ\rho(\mathcal{A}_{a}^{\text{hr}})\), (c) the adversarial image in \(\mathcal{H}\) obtained by the lifting method of [29; 30], (d) the adversarial image in \(\mathcal{H}\) obtained by the noise blowing-up method. The non-adversarial image referred to in (b) remains classified by \(\mathcal{C}\) in the \(c_{a}\) category, and the adversarial images referred to in (c) and (d) are classified in the \(c_{t}\) category mentioned in Table 14, with \(c_{t}\)-label values indicated in the Figures. With notations consistent with Tables 9 and 10, and with the exponent \(adv,lift\), and \(adv,noise\) indicating respectively that the adversarial images are obtained via the lifting method, and by the noise blowing-up method respectively, Table 15 gives a numerical assessment of the visual quality of the different HR images (b), (c), (d) compared to the clean ones (a) of Figures 8-10, as measured by \(L_{p}\) distances and FID values. Figures 8-10 show that, at some distance, both the non-adversarial resized image (b) and the HR adversarial images (c) and (d) seem to have a good visual quality as compared to the HR clean image (a). However, the zoomed areas show that details from the HR clean images become blurry in the HR adversarial images obtained by the lifting method (c) and in the non-adversarial resized images (b). Moreover, a human eye is not able to distinguish the blurriness that occurs in (b) from the one that shows up in (c): The loss of visual quality looks the same in both cases. However, a loss of visual quality does not occur (at least to the same extent) in the HR adversarial images obtained by the noise blowing-up method (d).