## 3 Results  
### Nontargeted Attacks Using Black-Box UAPs  
The performance of non-targeted UAPs was evaluated (Table 1). Overall, the fooling rate \(R_{f}\) of the UAPs was significantly higher than that of the random UAPs (random controls) and was hardly influenced by the randomness of the algorithm (i.e., random seed setting; see Table S2). Moreover, the difference between the clean images and their adversarial versions through the use of UAPs was almost imperceptible (Figure 1). The resultsindicate that small UAPs are generatable under black-box conditions. For each medical image dataset, however, the performance (\(R_{f}\)) might depend on the model architectures and norm type \(p\) of the UAPs. For the skin lesion image dataset, \(R_{f}\) achieved a score of \(>\)70% when \(p=2\) regardless of the model architecture; however, it was relatively low (\(\sim\)35%) for the UAPs with \(p=\infty\) against the ResNet50 and VGG16 models. A similar \(R_{f}\) (\(\sim\)65%) was also observed for the Inception V3 model when \(p=\infty\). For the OCT image dataset, \(R_{f}\) of the UAP with \(p=\infty\) was higher than that of the UAP with \(p=2\); in particular, the UAP with \(p=2\) against the ResNet50 model was less effective in causing a misclassification of the DNN model, although it still showed a slightly higher \(R_{f}\) in comparison to random UAPs. For the chest X-ray image dataset, \(R_{f}\) (\(\sim\)40%) of the UAPs against the Inception V3 model was slightly lower than that (\(\sim\)50%) of the UAPs against the ResNet50 and VGG16 models, regardless of the norm type.  
The confusion matrices (Figure 2) indicate that the adversarial images were classified into a few specific classes (e.g., dominant classes); however, the dominant classes might be different between the model architectures.  
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline \multirow{2}{*}{**Dataset/Architecture**} & \multicolumn{2}{c}{**Skin Lesion**} & \multicolumn{2}{c}{**OCT**} & \multicolumn{2}{c}{**Chest X-ray**} \\  & \(p=2\) & \(p=\infty\) & \(p=2\) & \(p=\infty\) & \(p=2\) & \(p=\infty\) \\ \hline Inception V3 & 78.8 (13.6) & 65.6 (10.2) & 31.7 (1.6) & 44.9 (3.3) & 41.8 (2.1) & 44.1 (2.6) \\ ResNet50 & 71.9 (11.1) & 33.9 (8.6) & 5.5 (1.3) & 69.3 (4.3) & 51.5 (5.9) & 50.9 (6.2) \\ VGG16 & 76.6 (5.3) & 38.9 (3.6) & 40.9 (0.7) & 75.1 (2.0) & 50.0 (1.8) & 50.0 (2.4) \\ \hline \hline \end{tabular}
\end{table}
Table 1: Fooling rates \(R_{f}\) (%) of UAPs for non-targeted attacks against DNN models for medical image datasets. Values in brackets indicate random controls (\(R_{f}\) of random UAPs).  
Figure 1: Clean images and their adversarial images generated using nontargeted UAPs against Inception V3 model, which has been widely used in previous studies on DNN-based medical imaging (e.g., [22; 23]) for (**a**) skin lesion, (**b**) OCT, and (**c**) chest X-ray image classifications. Here, \(p=2\) in (**a**,**c**) \(p=\infty\) in (**b**) in terms of the UAP performance (Table 1). Labels (without square brackets) next to the images are the predicted classes (see Table S1 for details). Each UAP is scaled by a maximum of 1 and a minimum of zero to visually emphasize UAPs.