## 2 CNNs and Attack Scenarios
### Attack Scenarios Expressed in the \(\mathcal{H}\) Domain  
In the context of high-resolution (HR) images, let us denote by \(\mathcal{H}\) the set of images that are larger than those of \(\mathcal{R}\). In other words, an image of size \(h\times w\) (where \(h\) designates the height, and \(w\) the width of the image considered) belongs to \(\mathcal{H}\) if \(h\geq r_{1}\) and \(w\geq r_{2}\). One assumes given a fixed _degradation function_  
\[\rho:\quad\mathcal{H}\xrightarrow{\quad}\mathcal{R}, \tag{3}\]  
that transforms any image \(\mathcal{I}\in\mathcal{H}\) into a \"degraded\" image \(\rho(\mathcal{I})\in\mathcal{R}\). Then there is a well-defined composition of maps \(\mathcal{C}\circ\rho\) as shown in the following scheme:  
(4)  
Given \(\mathcal{A}_{a}^{\text{hr}}\in\mathcal{H}\), one obtains that way the classification of the reduced image \(\mathcal{A}_{a}=\rho(\mathcal{A}_{a}^{\text{hr}})\in\mathcal{R}\) as \(\mathcal{C}(\mathcal{A}_{a})\in\mathcal{V}\). We assume that the dominating category of the reduced image \(\mathcal{A}_{a}\) is without ambiguity, and denote by \(\mathcal{C}(\mathcal{A}_{a})=(c_{a},\tau_{a})\in\mathcal{V}\) the outcome of \(\mathcal{C}\)'s classification of \(\mathcal{A}_{a}\). Thanks to the degradation function \(\rho\), one can express in the \(\mathcal{H}\) domain any attack scenario that makes sense in the \(\mathcal{R}\) domain. This is in particular the case for the _target scenario_ and for the _untarget scenario_. Indeed, an adversarial HR image against \(\mathcal{C}\) for the \((c_{a},c_{t})\)_target scenario_ performed by an attack \(atk_{\mathcal{H},\mathcal{C}}^{target}\) on \(\mathcal{A}_{a}^{\text{hr}}\in\mathcal{H}\) is an image \(\mathcal{D}_{t}^{\text{hr},\mathcal{C}}(\mathcal{A}_{a}^{\text{hr}})=atk_{ \mathcal{H},\mathcal{C}}^{target}(\mathcal{A}_{a}^{\text{hr}})\in\mathcal{H}\), that satisfies two conditions (note that the notation \(\mathcal{D}_{t}^{\text{hr},\mathcal{C}}(\mathcal{A}_{a}^{\text{hr}})\), with \(t\) as index, encapsulates and summarizes the fact that the adversarial image is obtained for the specific target scenario considered). On the one hand, a human should not be able to notice any visual difference between the original \(\mathcal{A}_{a}^{\text{hr}}\) and the adversarial \(\mathcal{D}_{t}^{\text{hr},\mathcal{C}}(\mathcal{A}_{a}^{\text{hr}})\) HR images. On the other hand, \(\mathcal{C}\) should classify the degraded image \(\mathcal{D}_{t}^{\mathcal{C}}(\mathcal{A}_{a}^{\text{hr}})=\rho(\mathcal{D}_{t }^{\text{hr},\mathcal{C}}(\mathcal{A}_{a}^{\text{hr}}))\) in the category \(c_{t}\) for a sufficiently convincing \(c_{t}\)-label value. The image \(\mathcal{D}_{t}^{\text{hr},\mathcal{C}}(\mathcal{A}_{a}^{\text{hr}})\in\mathcal{H}\) is then a _good enough adversarial image_ or a \(\tau\)-_strong adversarial image_ if its reduced version \(\mathcal{D}_{t}^{\mathcal{C}}(\mathcal{A}_{a}^{\text{hr}})=\rho(\mathcal{D}_{t }^{\text{hr},\mathcal{C}}(\mathcal{A}_{a}^{\text{hr}}))\) is. Similarly, and _mutatis mutandis_ for the _untarget scenario_, one denotes by \(\mathcal{D}_{\text{untarget}}^{\text{hr},\mathcal{C}}(\mathcal{A}_{a}^{\text{hr }})=atk_{\mathcal{H},\mathcal{C}}^{target}(\mathcal{A}_{a}^{\text{hr}})\) the HR adversarial images obtained by an attack \(atk_{\mathcal{H},\mathcal{C}}^{target}\) for the untarget scenario performed on \(\mathcal{A}_{a}^{\text{hr}}\in\mathcal{H}\), and by \(\mathcal{D}_{\text{untarget}}^{\mathcal{C}}(\mathcal{A}_{a}^{\text{hr}})\in \mathcal{R}\) its degraded version. The generic attack scenario on \(\mathcal{C}\) in the HR domain can be visualized in the following scheme:\[ \begin{CD}\mathcal{A}_{a}^{\text{hr}}\in\mathcal{H}@>{\text{}}>{\text{}}>\mathcal{D}_{ scenario}^{\text{hr},\mathcal{C}}(A_{a}^{\text{hr}})\in\mathcal{H}\\ @V{\rho}V{}V@V{}V{\rho}V\\ \mathcal{A}_{a}\in\mathcal{R}\\ c\bigg{\downarrow}\\ (c_{a},\tau_{a})\in\mathcal{V}\end{CD}