## 3 The Noise Blowing-Up Strategy  
The method presented here (and introduced in [31]) attempts to circumvent the speed, adversity, and visual quality challenges mentioned in the Introduction, which are encountered when one intends to create HR adversarial images. While speed and adversity were successfully addressed in [29; 30] via a strategy similar to some extent to the present one, the visual quality challenge remained partly unsolved. The refinement provided by our noise blowing-up strategy, which lifts to the \(\mathcal{H}\) domain for any attack working in the \(\mathcal{R}\) domain, addresses this visual quality issue without harming the speed and adversity features. It furthermore simplifies and generalises the attack scheme described in [29; 30]. In a nutshell, the noise blowing-up strategy applied to an attack \(atk\) on a CNN \(\mathcal{C}\) following a given _scenario_, essentially proceeds as follows. One considers a clean image \(\mathcal{A}_{a}\in\mathcal{R}\), degraded from a clean image \(\mathcal{A}_{a}^{\text{hr}}\in\mathcal{H}\) thanks to a degrading function \(\rho\). Then one performs an attack \(atk_{\mathcal{R},\mathcal{C}}^{scenario}\) on \(\mathcal{A}_{a}\) in the \(\mathcal{R}\) domain, that leads to an image \(\in\mathcal{R}\), adversarial against the CNN for the considered scenario. Although getting such adversarial images in the \(\mathcal{R}\) domain is crucial for obvious reasons, our strategy does not depend on how they are obtained and applies to all possible attacks \(atk_{\mathcal{R},\mathcal{C}}^{scenario}\) working efficiently in the \(\mathcal{R}\) domain. This feature contributes substantially to the flexibility of our method. Then one computes the adversarial noise in \(\mathcal{R}\) as the difference between the adversarial image and the clean image in \(\mathcal{R}\). Thanks to a convenient enlarging function \(\lambda\), one _blows up_ this adversarial noise from \(\mathcal{R}\) to \(\mathcal{H}\). Then, one adds this blown-up noise to \(\mathcal{A}_{a}^{\text{hr}}\), creating that way a high-resolution image, called here the _HR tentative adversarial image_. One checks whether this HR tentative adversarial image fulfills the criteria stated in the last paragraph of Section 2.3, namely becomes adversarial once degraded by the function \(\rho\). Should this occur, it means that blowing up the adversarial noise in \(\mathcal{R}\) has led to a noise in \(\mathcal{H}\) that turns out to be also adversarial. If the blown-up noise is not sufficiently adversarial, one raises the expectations at the \(\mathcal{R}\) level accordingly. The concrete design of the noise blowing-up strategy, which aims at creating an efficient attack in the \(\mathcal{H}\) domain once given an efficient attack in the \(\mathcal{R}\) domain for some _scenario_, is given step-by-step in Section 3.1. A series of indicators is given in Section 3.2. The assessment of these indicators depends on the choice of the degrading and enlarging functions used to go from \(\mathcal{H}\) to \(\mathcal{R}\), and vice versa. These choices are specified in Section 4. Constructing Images Adversarial in \(\mathcal{H}\) Out of Those Adversarial in \(\mathcal{R}\)  
Given a CNN \(\mathcal{C}\), the starting point is a large-size clean image \(\mathcal{A}_{a}^{\text{hr}}\in\mathcal{H}\). In Step 1, one constructs its degraded image \(\mathcal{A}_{a}=\rho(\mathcal{A}_{a}^{\text{hr}})\in\mathcal{R}\). In Step 2, one runs \(\mathcal{C}\) on \(\mathcal{A}_{a}\) to get its classification in a category \(c_{a}\). More precisely, one gets \(\mathcal{C}(\mathcal{A}_{a})=(c_{a},\tau_{a})\). In Step 3, with notations consistent with those used in Section 2.3, one assumes given an attack \(atk_{\mathcal{R},\mathcal{C}}^{\text{scenario}}\) on \(\mathcal{A}_{a}\) in the \(\mathcal{R}\) domain, that leads to an image  
\[\tilde{\mathcal{D}}_{scenario}^{\mathcal{C}}(\mathcal{A}_{a})\in\mathcal{R}, \tag{6}\]  
adversarial against CNN for the considered scenario. As already stated, how such an adversarial image is obtained does not matter.