## 4 Ingredients of the Experimental Study
### The Attacks
_-Fast Gradient Sign Method (FGSM)_[53] is a white-box attack that works by using the gradient of the loss function J(X,y) with respect to the input X to determine the direction in which the original input should be modified. FGSM is a one-step algorithm that can be executed quickly. In its untargeted version, the adversarial image is  
\[X^{adv}=X+esign(\Delta_{X}J(X,c_{a})), \tag{14}\]  
while in its targeted version it is  
\[X^{adv}=X-esign(\Delta_{X}J(X,c_{t})). \tag{15}\]  
where \(\epsilon\) is the perturbation size which is calculated with \(L_{inf}\) norm and \(\Delta\) is the gradient function. We set \(eps\_step=0.01\) and \(\epsilon=8/255\). _-Basic Iterative Method (BIM)_[54] is a white-box attack that is an iterative version of FGSM. BIM is a computationally expensive attack, as it requires calculating the gradient at each iteration. In BIM, the adversarial image \(X_{adv}\) is initialized with the original image \(X\) and gradually updated over a given number of steps \(N\) as follows:  
\[X^{adv}_{\ell+1}=Clip_{\epsilon}\{X^{adv}_{\ell}+\alpha sign(\Delta_{\mathcal{ A}}(J_{C}(X^{adv}_{\ell},c_{a})))\} \tag{16}\]  
in its untargeted version and  
\[X^{adv}_{\ell+1}=Clip_{\epsilon}\{X^{adv}_{\ell}-\alpha sign(\Delta_{\mathcal{ A}}(J_{C}(X^{adv}_{\ell},c_{t})))\}, \tag{17}\] \begin{table}
\begin{tabular}{c c c c c c c c c c c c c c c} \hline \hline \multirow{2}{*}{**Attacks**} & \multicolumn{2}{c}{**EA**} & \multicolumn{2}{c}{**AdvGAN**} & \multicolumn{2}{c}{**SimBA**} & \multicolumn{2}{c}{**FGSM**} & \multicolumn{2}{c}{**BIM**} & \multicolumn{2}{c}{**PGD Inf**} & \multicolumn{2}{c}{**PGD L2**} \\ \cline{2-19}  & **untag** & **targ** & **untag** & **targ** & **untag** & **targ** & **untag** & **targ** & **untag** & **targ** & **untag** & **targ** \\ \hline \(\mathcal{C}_{1}\) & 95 & 89 & 96 & 81 & 91 & 0 & 78 & 0 & 96 & 68 & 97 & 96 & 97 & 82 \\ \(\mathcal{C}_{2}\) & 95 & 92 & 94 & 85 & 94 & 0 & 63 & 2 & 98 & 78 & 99 & 98 & 99 & 90 \\ \(\mathcal{C}_{3}\) & 94 & 90 & 93 & 82 & 92 & 0 & 67 & 1 & 96 & 71 & 98 & 98 & 97 & 85 \\ \(\mathcal{C}_{4}\) & 94 & 90 & 81 & 88 & 91 & 0 & 64 & 0 & 96 & 84 & 97 & 97 & 97 & 94 \\ \(\mathcal{C}_{5}\) & 89 & 77 & 89 & 74 & 85 & 0 & 50 & 0 & 88 & 56 & 93 & 83 & 94 & 71 \\ \(\mathcal{C}_{6}\) & 95 & 94 & 92 & 79 & 90 & 0 & 84 & 1 & 96 & 96 & 97 & 98 & 96 & 98 \\ \(\mathcal{C}_{7}\) & 92 & 87 & 86 & 78 & 92 & 0 & 80 & 1 & 93 & 93 & 95 & 95 & 93 & 93 \\ \(\mathcal{C}_{8}\) & 86 & 93 & 88 & 74 & 78 & 0 & 75 & 0 & 94 & 94 & 95 & 95 & 89 & 94 \\ \(\mathcal{C}_{9}\) & 90 & 92 & 78 & 58 & 87 & 0 & 86 & 3 & 92 & 76 & 92 & 93 & 91 & 83 \\ \(\mathcal{C}_{10}\) & 90 & 94 & 79 & 59 & 87 & 1 & 87 & 1 & 92 & 77 & 93 & 94 & 92 & 84 \\ \hline \(max\) & 0.546 & 0.555 & 0.762 & 0.481 & 0.508 & 0.041 & 0.993 & 0.457 & 0.999 & 0.999 & 0.999 & 0.999 & 0.999 & 0.999 \\ \(min\) & 0.007 & 0.550 & 0.003 & 0.031 & 0.038 & 0.041 & 0.050 & 0.257 & 0.258 & 0.289 & 0.524 & 0.721 & 0.277 & 0.221 \\ avg & 0.359 & 0.551 & 0.150 & 0.255 & 0.352 & 0.041 & 0.522 & 0.340 & 0.958 & 0.901 & 0.987 & 0.986 & 0.966 & 0.943 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Number of successfully generated adversarial images in the \(\mathcal{R}\) domain. in its targeted version, where \(\alpha\) is the step size at each iteration and \(\epsilon\) is the maximum perturbation magnitude of \(X^{adv}=X^{adv}_{N}\). We use the \(eps\_step=0.1\), \(max\_iter=100\), and \(\epsilon=2/255\). _-Projected Gradient Descent Infinite (PGD Inf)_[55] is a white-box attack that is similar to the BIM attack, but with some key differences. In PGD Inf, the initial adversarial image is not set to the original image \(X\), but rather to a random point within an \(L_{p}\)-ball around \(X\). The distance between \(X\) and \(X^{adv}\) is measured using the \(L_{norm}\). For our experiments, we set the norm parameter to \(\infty\), which indicates the use of the \(L_{\infty}\) norm. We also set the step size parameter \(eps\_step\) to 0.1, the batch size to 32, and the maximum perturbation magnitude \(\epsilon\) to 8/255.