## 5 Experimental Results of the Noise Blowing-Up Method
### Interpretation of the Results of Phase 2
In this latter case, the adversarial noise leveraged to create the tentative adversarial image by the noise blowing-up process is much more sensitive to minor perturbations, with similar consequences as those already encountered in the target scenario. **Visual quality of the adversarial images:** The values of \(L^{norm,adv}_{\mathcal{R}}\) in Table 9 (resp. Table 10) show that the attacks performed for the target scenario manipulate on average 82% of the pixels of the downsized (hence in \(\mathcal{R}\)) clean image (resp. 94% for the untarget scenario). Nevertheless, the values of \(L^{norm,adv}_{\mathcal{H}}\) in both tables (hence in the larger \(\mathcal{H}\) domain, after the noise blowing-up process) are lower, with an overall average of 74% for the targeted scenario (resp. 83% for the untargeted scenario). This trend is consistent across all \(L_{p}\) values (\(p=0,1,2,\infty\)), with \(L^{norm,adv}_{p,\mathcal{R}}\) generally higher than the corresponding \(L^{norm,adv}_{p,\mathcal{H}}\) values for all attacks (the values are closely aligned, though, for \(p=\infty\)). Additionally, \(\mathrm{FID}^{adv}_{\mathcal{H}}\) values, comparing clean and adversarial images obtained by the noise blowing-up method, ranging between 5.3 (achieved by BIM) and 17.6 in the targeted scenario (with average 11.1, see Table 9), and between 3.7 (achieved by EA) and 49.5 in the untargeted scenario (with average 16.5, see Table 10), are significantly low (it is not uncommon to have values in the range 300-500). In other words, the adversarial images maintain a visual quality and proximity to their clean counterparts. It is important to highlight that the simple operation of scaling down and up the clean images results in even larger \(L^{norm,clean}_{p,\mathcal{H}}\) values than \(L^{norm,adv}_{p,\mathcal{H}}\) for \(p=0,1,\infty\) for all attacks and scenarios (see Tables 9 and 10; note that the values for \(p=2\) are too small to assess the phenomenon described above). When one compares \(\mathrm{FID}^{clean}_{\mathcal{H}}\) to \(\mathrm{FID}^{adv}_{\mathcal{H}}\), the same phenomenon occurs for three out of 4 targeted attacks (EA is the exception), and for five out of 7 untargeted attacks (FGSM and PGD Inf being the exceptions). More precisely, the 1 st column of Figure 3 displays the HR clean images \(\mathcal{A}_{1}^{2}\), \(\mathcal{A}_{6}^{3}\), and \(\mathcal{A}_{10}^{10}\). The 2 nd column displays the non-adversarial \(\lambda\circ\rho(\mathcal{A}_{a}^{\text{hr}})\in\mathcal{H}\) images, as well as the corresponding \(L_{p,\mathcal{H}}^{norm,clean}\ (p=0,1,\infty)\) and FID\({}_{\mathcal{H}}^{clean}\) values (in that order). HR adversarial images \(\mathcal{D}_{tar}^{\text{hr},\mathcal{C}}(\mathcal{A}_{a}^{\text{hr}})\) are displayed in the 3 rd and 4 th columns: For \(atk=\text{EA}\) performed on \(\mathcal{C}_{4}=\text{WebsiteNet}\) for the targeted scenario in the 3 rd column, and for \(atk=\text{BIM}\) on \(\mathcal{C}_{6}=\text{ResNet50}\) for the untargeted scenario in the 4 th column. The corresponding numerical values of \(L_{p,\mathcal{H}}^{norm,adv}\ (p=0,1,\infty)\) and of FID\({}_{\mathcal{H}}^{adv}\) (in that order) are provided as well. **Speed of the noise blowing-up method:** The outcomes of Tables 11 and 12 for the overhead of the noise blowing-up method (all steps except Step 3) and its relative cost as compared to the actual attack (performed in Step 3) are twofold. Firstly, the performance of the noise blowing-up strategy depends on the size of the image: It is substantially faster (between 3.24 times and 6.31 times on average) for smaller than for larger HR clean images. Secondly, and this is probably the most important outcome of both, the noise blowing-up method demonstrates exceptional speed both in absolute and in relative terms, and consequently an exceptionally minimal overhead, even for large-size HR clean images.