# Empirical Perturbation Analysis of Two Adversarial Attacks: Black Box versus White Box
## 6 Transferability of the Adversarial Noise at Smaller Image Regions
### Effects of Shuffling on Adversarial Images' Transferability  
Here, we do not change the intensity of the noise. That is, \(f=100\%\). The point is no longer to visualize the graph of the evolution of the \(c_{t}\)-label values of shuffled adversarials but to focus on their actual values for the \"real\" noise (at \(f=100\%\)). The issue is to check whether the adversarial images are more likely to transfer when they are shuffled. We proceed as follows. We input the unshuffled ancestor \(\mathcal{A}_{q}^{p}\) and the unshuffled adversarial \(\mathcal{D}_{k}^{\mathit{atk}}(\mathcal{A}_{q}^{p})\) to all \(\mathcal{C}_{i}\)'s for \(i\
eq k\) (hence, all CNNs except the targeted one). We extract the \(c_{a}\) and \(c_{t}\)-label values for each \(i\), namely \(c_{a}^{i}(\mathcal{A}_{q}^{p})\), \(c_{a}^{i}(\mathcal{D}_{k}^{\mathit{atk}}(\mathcal{A}_{q}^{p}))\), \(c_{t}^{i}(\mathcal{A}_{q}^{p})\), and \(c_{t}^{i}(\mathcal{D}_{k}^{\mathit{atk}}(\mathcal{A}_{q}^{p}))\). We compute the difference in the \(c_{a}\)-label values between the two images for each \(i\) and, similarly, the difference in the \(c_{t}\)-label values to obtain  
\[\Delta_{a}^{k,i}(\mathcal{A}_{q}^{p})=c_{a}^{i}(\mathcal{D}_{k}^{\mathit{atk}} (\mathcal{A}_{q}^{p}))-c_{a}^{i}(\mathcal{A}_{q}^{p}),\quad\Delta_{t}^{k,i}( \mathcal{A}_{q}^{p})=c_{t}^{i}(\mathcal{D}_{k}^{\mathit{atk}}(\mathcal{A}_{q} ^{p}))-c_{t}^{i}(\mathcal{A}_{q}^{p}).\]  
For \(s=32,56\) and \(112\), this process is repeated with the shuffled ancestor \(\mathit{sh}(\mathcal{A}_{q}^{p},s)\) and the shuffled adversarial \(\mathit{sh}(\mathcal{D}_{\mathit{atk}}^{\mathit{atk}}(\mathcal{A}_{q}^{p}),s)\), yielding the following differences:  
\[\Delta_{a}^{k,i}(\mathit{sh}(\mathcal{A}_{q}^{p},s))=c_{a}^{i}(\mathit{sh}( \mathcal{D}_{k}^{\mathit{atk}}(\mathcal{A}_{q}^{p}),s))-c_{a}^{i}(\mathit{sh}( \mathcal{A}_{q}^{p},s)),\]  
and  
\[\Delta_{t}^{k,i}(\mathit{sh}(\mathcal{D}_{k}^{\mathit{atk}}(\mathcal{A}_{q}^{ p}),s))=c_{t}^{i}(\mathit{sh}(\mathcal{D}_{k}^{\mathit{atk}}(\mathcal{A}_{q}^{p}),s))-c_{t}^ {i}(\mathit{sh}(\mathcal{A}_{q}^{p}),s).\]  
These \(\Delta^{k,i}\) assess the impact of the adversarial noise both when unshuffled and shuffled. Regarding the \(c_{a}\)-label values, both differences are \(\leq\)0 (the \(c_{a}\)-label value of the ancestor dominates the \(c_{a}\)-label value of the adversarial, shuffled or not). We consider the absolute value of both quantities (\(k\) and \(i\) are fixed). Finally, we compute the percentage over all \(k\), all \(i\
eq k\), of all convenient ancestors \(\mathcal{A}_{q}^{p}\) for which  
Figure 7: Evolution of \(\mathit{log}(o[a])\), \(\mathit{log}(o[t])\), and \(\mathit{log}(max(o))\) for \(\mathcal{D}_{6}^{\mathit{atk}}(\mathcal{A}_{5}^{4})\) (a) and for \(\mathit{sh}(\mathcal{D}_{6}^{\mathit{atk}}(\mathcal{A}_{5}^{4}),s)\) for \(s=32\) (b), \(s=56\) (c) and \(s=112\) (d) when fed to \(\mathcal{C}_{6}\), \(\mathcal{C}_{9}\), and \(\mathcal{C}_{1}\) (first, second, and third rows of each set of graphs, respectively), when the noise is impacted by a factor \(f\in[0\%,300\%]\). \[|\Delta_{a}^{k,i}(sh(\mathcal{A}_{q}^{p},s))|\geq|\Delta_{a}^{k,i}(\mathcal{A}_{ q}^{p})|.\]  
Regarding the \(c_{t}\)-label values, both differences are \(\geq 0\) (this is obvious for the unshuffled images and turns out to be the case for the shuffled one). In this case, there is therefore no need to take the absolute values. We compute the percentage over all \(k\), all \(i\
eq k\), of all convenient ancestors \(\mathcal{A}_{q}^{p}\) for which  
\[\Delta_{t}^{k,i}(sh(\mathcal{A}_{q}^{p},s))\geq\Delta_{t}^{k,i}(\mathcal{A}_ {q}^{p}).\]  
Table 4 presents the outcome of these computations for each value of \(s\) and for the adversarials obtained by both attacks. Note that we do not simply present the \(c_{t}\)-label values of shuffled adversarial images because, then, the measured impact could have two sources: either the adversarial noise or the fact that the \(c_{a}\) shape is distorted by shuffling, leaving room for the \(c_{t}\)-label value to increase.