## 3 The Noise Blowing-Up Strategy
### Indicators  
Although both \(\hat{\mathcal{D}}^{\mathcal{C}}_{\mathit{scenario}}(\mathcal{A}_{a})\) and \(\mathcal{D}^{\mathcal{C}}_{\mathit{scenario}}(\mathcal{A}_{a}^{\mathrm{hr}})\) stem from \(\mathcal{A}_{a}^{\mathrm{hr}}\), belong to the same set \(\mathcal{R}\) of low-resolution images, these images nevertheless differ in general, since \(\rho\circ\lambda\
eq\mathit{id}_{\mathcal{R}}\). Therefore, as already stated, this fact implies that the verification process performed in Step 8 is mandatory. For the **target scenario**, one aims at \(c_{\mathit{aft}}=c_{\mathit{bef}}=c_{t}\). Since \(\tilde{\tau}_{c_{t}}\) and \(\tau_{c_{t}}\) are likely to differ, One measures the difference with the real-valued _loss function_\(\mathcal{L}\) defined for \(\mathcal{A}_{a}^{\mathrm{hr}}\in\mathcal{H}\) as  
\[\mathcal{L}_{\mathcal{C}}(\mathcal{A}_{a}^{\mathrm{hr}})=\tilde{\tau}_{c_{t}}- \tau_{c_{t}}. \tag{12}\]  
In particular, for the target scenario, our attack is effective if one can set accurately the value of \(\tilde{\tau}_{t}\) to match the inequality \(\tau_{t}\geq\tau\) for the threshold value \(\tau\), or to make sure that \(\mathcal{D}^{\mathcal{C}}_{t}(\mathcal{A}_{a}^{\mathrm{hr}})\) is a good enough adversarial image in the \(\mathcal{R}\) domain while controlling the distance variations between \(\mathcal{A}_{a}^{\mathrm{hr}}\) and the adversarial \(\mathcal{D}_{t}^{\mathrm{hr},\mathcal{C}}(\mathcal{A}_{a}^{\mathrm{hr}})\). For the **untarget scenario**, one aims at \(c_{\mathit{aft}}\
eq c_{a}\). To hope to achieve \(c_{\mathit{aft}}\
eq c_{a}\), one requires \(c_{\mathit{bef}}\
eq c_{a}\). However, this requirement alone may not be sufficient to obtain \(c_{\mathit{aft}}\
eq c_{a}\). Indeed, depending on the attack, the adversarial image \(\mathcal{D}^{\mathcal{C}}_{\mathit{untarget}}(\mathcal{A}_{a}^{\mathrm{hr}})\) (in the \(\mathcal{R}\) domain) may be very sensitive to the level of trust that \(\hat{\mathcal{D}}^{\mathcal{C}}_{\mathit{untarget}}(\mathcal{A}_{a}^{\mathrm{ hr}})\) (also in the \(\mathcal{R}\) domain) belongs to the category \(c_{\mathit{bef}}\). In other words, even if the attack performed in step 3 of the noise blowing-up strategy succeeded, steps 5 to 9 may not succeed under some circumstances, and it may occur that the image resulting from these steps is classified back to \(c_{a}\). Although less pregnant for the **target scenario**, a similar sensitivity phenomenon may nevertheless occur, leading to \(c_{\mathit{aft}}\
eq c_{\mathit{bef}}\) (hence to \(c_{\mathit{aft}}\
eq c_{t}\), since \(c_{\mathit{bef}}=c_{t}\) in this scenario), and therefore to an unsuccess of the noise blowing-up strategy. For these reasons, it may be safer to ensure a \"margin of security\" measured as follows. One defines the _Delta function_\(\Delta_{\mathcal{C}}\) for \(\mathcal{A}_{a}^{\mathrm{hr}}\in\mathcal{H}\) as:  
\[\Delta_{\mathcal{C}}(\mathcal{A}_{a}^{\mathrm{hr}})=\tilde{\tau}_{c_{\mathit{ bef}}}-\tilde{\tau}_{c_{\mathit{next},\mathit{bef}}}, \tag{13}\]  
where \(c_{\mathit{next},\mathit{bef}}\) is the second best category, namely the category \(c\) for which the label value \(\tilde{\tau}_{c}\) is the highest after the label value \(\tilde{\tau}_{c_{\mathit{bef}}}\) of \(c_{\mathit{bef}}\). Enlarging the distance of the label values between the best and second best category before launching the next steps of the noise blowing-up strategy may lead to higher success rates of the strategy (see Section 6). **Remark.--**Note that the present approach, at the difference of the approach, initially introduced in [29; 30], does not require frequent resizing up and down via \(\lambda,\rho\) the adversarial images. In particular, if one knows how the loss function behaves (in the worst case, or in average) for a given targeted attack, then one can adjust _a priori_ the value of accordingly, and be satisfied with one such resizing up and down. _Mutatis mutandis_ for the untarget attack and the Delta function.