## 4 Ingredients of the Experimental Study
### The Attacks  
We considered seven well-known attacks against the 10 CNNs given in Table 1. Table 4 lists these attacks, and specifies (with an \"x\") whether we use them in the experiments for the targeted scenario, for the untargeted scenario, or for both (see Table 5 for a justification of these choices), and their white-box or black-box nature. To be more precise, if an attack admits a dual nature, namely black box and white-box (potentially semi-white-box), we consider the attack only in its more demanding black-box nature. This leads us to consider three black-box attacks (EA, AdvGAN, SimBA) and four white-box attacks (FGSM, BIM, PGD Inf, PGD L2). Let us now briefly describe these attacks while specifying the parameters to be used in the experiments. Note that, except (for the time being) for the EA attack, all attacks were applied with the Adversarial Robustness Toolbox (ART) [50], which is a Python library that includes several attack methods. \(-\)_EA attack_[25, 27] is an evolutionary algorithm-based black-box attack. It begins by creating a population of ancestor image copies and iteratively modifies their pixels over generations. The attack's objective is defined by a fitness function that uses an individual's \(c_{t}\) probability obtained from the targeted CNN. The population size is set to 40, and the pixel mutation magnitude per generation is \(\alpha=1/255\). The attack is executed in both targeted and untargeted scenarios. For the targeted scenario, the adversarial image's minimum \(c_{t}\)-label value is set to \(\hat{\tau}_{t}\geq 0.55\). The maximum number of generations is set to \(N=10\),000. \begin{table}
\begin{tabular}{l c c c c} \hline \hline
**Attacks** & **White Box** & **Black Box** & **Targeted** & **Untargeted** \\ \hline EA & & x & x & x \\ advGAN & & x & x & x \\ SimBA & & x & & x \\ FGSM & x & & x \\ BIM & x & & x & x \\ PGD Inf & x & & x & x \\ PGD \(L2\) & x & & x & x \\ \hline \hline \end{tabular}
\end{table} 
Table 4: List of attacks considered, their white-box or black-box nature, and the scenarios for which they are run in the present study. \begin{table}
\begin{tabular}{l c c c c c c c c c c} \hline \hline \(\mathcal{C}\) & \(\mathcal{C}_{1}\) & \(\mathcal{C}_{2}\) & \(\mathcal{C}_{3}\) & \(\mathcal{C}_{4}\) & \(\mathcal{C}_{5}\) & \(\mathcal{C}_{6}\) & \(\mathcal{C}_{7}\) & \(\mathcal{C}_{8}\) & \(\mathcal{C}_{9}\) & \(\mathcal{C}_{10}\) \\ \hline \(\#\mathcal{S}_{clean}^{c}(L)\) & 97 & 99 & 98 & 97 & 95 & 98 & 95 & 95 & 93 & 94 \\ \(\#\mathcal{S}_{clean}^{c}(N)\) & 99 & 97 & 97 & 95 & 94 & 97 & 95 & 94 & 93 & 94 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: For each CNN \(\mathcal{C}_{k}\) (1 st row), number of clean HR images \(\mathcal{A}_{q}^{p}\) classified by \(\mathcal{C}_{k}\) in the “correct” category \(c_{a_{q}}\) either with the degrading function \(\rho=\) “Lanczos” (2 nd row), or with \(\rho=\) “Nearest” (3 rd row). _-Adversarial GAN attack (AdvGAN)_[51] is a type of attack that operates in either a semi-whitebox or black-box setting. It uses a generative adversarial network (GAN) to create adversarial images by employing three key components: a generator, a discriminator, and the targeted neural network. During the attack, the generator is trained to produce perturbations that can convert original images into adversarial images, while the discriminator ensures that the generated adversarial image appears identical to the original image. The attack is executed in the black-box setting. _-Simple Black-box Attack (SimBA)_[52] is a versatile algorithm that can be used for both black-box and white-box attacks. It works by randomly selecting a vector from a predefined orthonormal basis and adding or subtracting it from the target image. SimBA is a simple and effective method that can be used for both targeted and untargeted attacks. For our experiments, we utilized SimBA in the black-box setting with the overshoot parameter epsilon set to 0.2, batch size set to 1, and the maximum number of generations set to 10,000 for both targeted and untargeted attacks.