## Appendix B Choice of \((\rho,\lambda,\rho)\) Based on a Case Study  
Our previous papers [29; 30] showed the sensitivity of tentative adversarial images to the choice of the degrading and enlarging functions. In the present Appendix B, wetherefore, want to find out which degrading and enlarging functions \(\rho\) and \(\lambda\), and which combination \((\rho,\lambda,\rho)\), used in Scheme (11), provide the best outcome in terms of image quality and of adversity. For this purpose, we perform a case study. Based on the results of [29; 30], the study is limited to the consideration of the \"Lanczos\" (L) and \"Nearest\" (N) functions, either for the degrading function \(\rho\) or for the enlarging function \(\lambda\). This leads to 8 combinations for \((\rho,\lambda,\rho)\), namely (with obvious notations) L-L-L, L-L-N, L-N-L, N-L-L, L-N-N, N-L-N, N-N-L and N-N-N.  
For each such combination \((\rho,\lambda,\rho)\), the study is performed on the 100 clean images \(\mathcal{A}_{q}^{p}\) represented in Figure 11, with the EA-based targeted attack against the CNN \(\mathcal{C}=\mathcal{C}_{9}=\) VGG-16, according to the pairs \((c_{a},c_{t})\) specified in Table 2.  
However, although the images \(\mathcal{A}_{q}^{p}\) are picked from the ImageNet validation set in the categories \(c_{a_{q}}\), VGG-16 does not systematically classify all of them in the \"correct\" category \(c_{a_{q}}\) in the process of Steps 1 and 2 of Scheme (11). Indeed, Tables 12 and 13 in Appendix A show that VGG-16 classifies \"correctly\" only 93 clean images \(\mathcal{A}_{q}^{p}\), and classifies \"wrongly\" 7 when the degrading function used in Step 1 is \(\rho=\) L or is \(\rho=\) N. Let us observe that although the number of \"correctly\" classified and of \"wrongly\" classified images are the same independently on the \(\rho\) function used, the actual such images \(\mathcal{A}_{q}^{p}\) are not necessarily the same. The rest of the experiments are therefore performed on the set \(\mathcal{S}_{clean}^{\text{VGG-16}}(\rho)=93\) of \"correctly\" classified clean images. With this setting, the targeted attack aims at creating 0.55-strong adversarial images in the \(\mathcal{R}\) domain (hence meaning that it aims at creating images for which \(\tilde{\tau}_{t}\geq 0.55\)). As explained in Section 4.4, the attack succeeds when a 0.55-strong adversarial image in the \(\mathcal{R}\) domain is obtained within 10,000 generations. In the present case study, we also keep track of the unsuccessful such attacks. More precisely, for the \(\mathcal{S}_{clean}^{\text{VGG-16}}(\rho)=93\) images considered, we also report the cases where either the best tentative adversarial image in the \(\mathcal{R}\) domain, obtained after 10,000 generations, is classified in \(c_{t}\) but with a label value \(<\)0.55, or is classified in a category \(c\
eq c_{a},c_{t}\), or is classified back to \(c=c_{a}\). Note _en passant_ that, although unsuccessful for the 0.55-target scenario, the attack in the \(\mathcal{R}\) domain is successful at creating good enough adversarial images in the first case considered in the previous paragraph, respectively for the untarget scenario in the second case. In the present study, Scheme (11) continues with Steps 4 to 8 only for the adversarial images that correspond to the first or the second component of the quadruplet in \(\mathcal{R}\), namely those obtained in Step 3 that are classified in \(c_{t}\). Note that we compute the average of the \(\tilde{\tau}_{c}=\tilde{\tau}_{t}\) for these images. At the end of Step 8, we collect the following data: the number of HR tentative adversarial images classified in \(c_{t}\) (hence adversarial for the target scenario), classified in \(c\
eq c_{a},c_{t}\) (hence adversarial for the untarget scenario), classified back in \(c_{a}\) (not adversarial at all).