# Empirical Perturbation Analysis of Two Adversarial Attacks: Black Box versus White Box
## 6 Transferability of the Adversarial Noise at Smaller Image Regions  
On the one hand, the very low transferability rate observed in Section 5 shows that most obtained adversarial images are specific to the CNNs they fool. On the other hand, the size of the covered region increases linearly with successive CNN layers [36]. Moreover, the similarity between the features captured by different CNNs is higher in earlier layers than in later layers [37,38]. Roughly speaking, the earlier layers tend to capture information of a general nature, common to all CNNs, whereas the features captured by the later layers diverge from one CNN to another.  
The question addressed in this section goes in the direction of a potential stratification of the adversarial noise's impact according to the successive layers of the CNNs. In other words, this amounts to clarifying whether it is possible to sieve the adversarial noise, so that one would identify the part of the noise (if any) that has an adversarial impact for all CNNs up to some layers, and the part of the noise in which adversarial impact becomes CNN-specific from some layer on. This is a difficult challenge since the adversarial noise is modified continuously until a convenient adversarial image is created. In particular, the \"initial\" noise, created at some early point of the process and potentially adversarial for the first layers of different CNNs, is likely to be modified as well during this process, and to  
Figure 6: Heatmaps obtained with the ancestor \(\mathcal{A}=\mathcal{A}_{10}^{8}\) and the adversarial image \(\mathcal{D}(\mathcal{A})=\mathcal{D}_{6}^{\mu k}(\mathcal{A}_{10}^{8})\) pictured in **(a)**, where \(\mu k=\text{EA}\) in the \(1^{st}\) row and \(\mu k=\text{BIM}\) in the 2 nd row. From **(b–e)**, the heat maps are created using BagNet-17 and represent the following: 10% smallest values of \(c_{a}(P(\mathcal{D}(\mathcal{A})))-c_{a}(P(\mathcal{A}))\) **(b)**; 10% largest values of \(c_{t}(P(\mathcal{D}(\mathcal{A})))-c_{t}(P(\mathcal{A}))\) **(c)**; 10% largest values of \(c_{a}(P(\mathcal{D}(\mathcal{A})))-c_{t}(P(\mathcal{D}(\mathcal{A})))\) **(d)**; 10% largest values of \(c_{t}(P(\mathcal{D}(\mathcal{A})))-c_{a}(P(\mathcal{D}(\mathcal{A})))\) **(e)**. Heatmap (f) is obtained with \(\mathcal{C}_{k}\) and represents the 10% largest values of \(c_{t}(IP(\mathcal{D}(\mathcal{A})))-c_{t}(\mathcal{A})\).  
lose its initial \"quasi-universal\" adversarial characteristic, potentially to the benefit of a new adversarial noise. Note _en passant_ that a careful study in this direction may contribute to \"reverse engineer\" a CNN, namely to reconstruct its architecture (up to a point). This direction is only indicated here and is not explored in full details at this stage.  
More modestly and more specifically, in this section, we ask whether the adversarial noise for regions of smaller sizes is less CNN-specific and, hence, more transferable than at full scale, namely \(224\times 224\) in the present case, where we know that, in general, it is not transferable.  
This issue is addressed in two ways. First, we check whether and how a modification of the adversarial noise intensity affects the \(c_{a}\) and the \(c_{t}\)-label values of an image, adversarial for a given CNN, when exposed to a different CNN, and the influence of shuffling in this process (Section 6.1). Second, we keep the adversarial noise as it is, and we check whether adversarial images are more likely to transfer when they are shuffled (Section 6.2).