## Appendix D Overall FID Results  
In Tables 13 and 14, we present the average FID values (lower is better) for successfully generated high-resolution adversarial images, presented per attack and CNN. Specifically, Table 13 shows FID values for the images generated by targeted attacks (EA, BIM, PGD Inf, PGD L2), while Table 14 displays FID values of the images generated by untargeted attacks (EA, AdvGAN, SimBA, FGSM, BIM, PGD Inf, PGD L2). * [PERSON] et al. (2022) [PERSON]; [PERSON]; [PERSON] Integration of digital quality control for intelligent manufacturing of industrial ceramic tiles. _Ceram. Int._**2022**, _48_, 34210-34233. [CrossRef]
* [PERSON] and [PERSON] (2023) [PERSON]; [PERSON] Advanced road extraction using CNN-based U-Net model and satellite imagery. _E-Prime Electr. Eng. Electron. Energy_**2023**, \(5\), 100244. [CrossRef]
* [PERSON] and [PERSON] (2022) [PERSON]; [PERSON] Semantic segmentation of land cover from high resolution multispectral satellite images by spectral-spatial convolutional neural network. _Geocrta Int._**2022**, _37_, 657-677. [CrossRef]
* [PERSON] et al. (2022) [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON] 360-attack: Distortion-aware perturbations from perspectiveviews. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, New Orleans, LA, USA, 18-24 June 2022 ; pp. 15035-15044. * [PERSON] et al. (2014) [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON] Your online interests: Pwned! a pollution attack against targeted advertising. In Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security, Scottsdale, AZ, USA, 3-7 November 2014; pp. 129-140. * [PERSON] and [PERSON] (2012) [PERSON]; [PERSON] Privacy-aware personalization for mobile advertising. In Proceedings of the 2012 ACM Conference on Computer and Communications Security, Raleigh, NC, USA, 16-18 October 2012; pp. 662-673. * [PERSON] et al. (2013) [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON] Evasion attacks against machine learning at test time. In Proceedings of the Joint European Conference on Machine Learning and Knowledge Discovery in Databases, Prague, Czech Republic, 23-27 September 2013; Springer: Berlin/Heidelberg, Germany, 2013, pp. 387-402. * [PERSON] et al. (2017) [PERSON]; [PERSON] Towards evaluating the robustness of neural networks. In Proceedings of the 2017 IEEE Symposium on Security and Privacy (SP), San Jose, CA, USA, 22-26 May 2017; pp. 39-57. * [PERSON] et al. (2021) [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON] IWA: Integrated Gradient based White-box Attacks for Fooling Deep Neural Networks. _arXiv_**2021**, arXiv:2102.02128. * [PERSON] et al. (2023) [PERSON]; [PERSON]; [PERSON] A gradient-based approach for adversarial attack on deep learning-based network intrusion detection systems. _Appl. Soft Comput._**2023**, _137_, 110173. [CrossRef]
* [PERSON] et al. (2017) [PERSON]; [PERSON]; [PERSON] [PERSON]; [PERSON]; [PERSON]; [PERSON] Practical black-box attacks against machine learning. In Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security, Abu Dhabi, United Arab Emirates, 2-7 April 2017; pp. 506-519. * [PERSON] et al. (2020) [PERSON]; [PERSON]; [PERSON] [PERSON]; [PERSON] [PERSON] Square attack: A query-efficient black-box adversarial attack via random search. In _European Conference on Computer Vision_; Springer: Cham, Switzerland, 2020; pp. 484-501. * [PERSON] et al. (2020) [PERSON]; [PERSON] [PERSON]; [PERSON] A proof of concept to deceive humans and machines at image classification with evolutionary algorithms. In Proceedings of the Intelligent Information and Database Systems, 12 th Asian Conference, ACIIDS 2020, Phuket, Thailand, 23-26 March 2020; Springer: Berlin/Heidelberg, Germany, 2020; pp. 467-480. * [PERSON] (2020) [PERSON]; [PERSON]; [PERSON] [PERSON] Evolutionary algorithms deceive humans and machines at image classification: An extended proof of concept on two scenarios. _J. Inf. Telecommun._**2020**, \(5\), 121-143.