## 2 Materials and Methods  
### Simple Black-Box Algorithm for UAPs  
Our black-box algorithm (Algorithm 1) is an extension of the SimBA method [18], which generates input-dependent perturbations to generate UAPs; in particular, we combined the SimBA method with simple iterative methods for generating UAPs under white-box conditions [12; 13]. Similar to the SimBA method, our algorithm considers a black-box classifier \(C\) that returns the confidence score output probability \(p_{C}(y|x)\) of class \(y\) given input image \(x\). Here, \(C(x)\) indicates the class or label (with the highest confidence score) for \(x\) (i.e., \(\operatorname*{arg\,max}_{y^{\prime}}p_{C}(y^{\prime}|x)\)). The algorithm starts with \(\delta=\mathbf{0}\) (i.e., no perturbations) and iteratively updates the UAP \(\delta\) using a direction \(\mathbf{q}\) randomly sampled from a set \(\mathbf{Q}\) of search directions with attack strength \(\epsilon\) under the constraint in which the \(L_{p}\) norm of the UAP is equal to or less than a small value \(\zeta\) (i.e., \(\delta_{p}\leq\zeta\)). For project \((\delta,p,\ \zeta)\), a projection function is used to satisfy the constraint and is specifically defined as follows:  
\[\text{project}(\delta,p,\ \zeta)=\operatorname*{arg\,min}_{\delta^{*}}|| \delta-\delta^{*}||_{2}\ \ \ \text{s.t.}\ \ ||\delta^{*}||_{p}\leq\zeta \tag{1}\]  
For nontargeted attacks, the updated UAP vector \(\delta^{\prime}\) is accepted if the update from \(\delta\) to \(\delta^{\prime}\) contributes to decreasing the confidence scores for their labels \(C(x)\) predicted without the UAP of any \(x\) in an input image set \(\mathbf{X}\). As shown in Algorithm 1, the update is accepted if the following simple condition is satisfied (true):  
\[\sum_{\mathbf{x}\in\mathbf{X}}p_{C}(C(\mathbf{x})|\mathbf{x}+\delta^{\prime})<\sum_{\mathbf{x}\in \mathbf{X}}p_{C}(C(\mathbf{x})|\mathbf{x}+\delta). \tag{2}\]  
This corresponds to considering the average search directions obtained from input images to generate a UAP; thus, it is analogous to an approach [24] to generate a UAP using the norm of the loss gradients estimated from the outputs of a hidden layer with respect to inputs. Targeted UAPs can also be implemented by modifying this condition (electronic Supplementary Material, Algorithm S1). Specifically, in this case, because the algorithm accepts an updated UAP vector if the update overall contributes to increasing the confidence score for a target class \(y\) of any \(\mathbf{x}\) in \(\mathbf{X}\), the update is accepted if  
\[\sum_{\mathbf{x}\in\mathbf{X}}p_{C}(y|\mathbf{x}+\delta^{\prime})>\sum_{\mathbf{x}\in\mathbf{X}}p_ {C}(y|\mathbf{x}+\delta). \tag{3}\]  
Several types of search directions \(\mathbf{Q}\) were considered. As mentioned in a previous study [18], a natural choice for \(\mathbf{Q}\) may be the standard basis \(\mathbf{Q}=\mathbf{I}\), for which \(\mathbf{q}\) corresponds to a random pixel attack. However, this may be less effective for inputs with a large space (i.e., large images). In this case, a discrete cosine basis is useful because random noise in a low-frequency space contributes to adversarial attacks [17]. The set \(\mathbf{Q}_{\text{DCT}}\) of the orthonormal frequencies was extracted using the discrete cosine transform. Assuming a two-dimensional image space \(\mathbb{R}^{d\times d}\), \(\mathbf{Q}_{\text{DCT}}\) has \(d\times d\) frequencies; however, a fraction \(f_{d}\) of the lowest frequency directions is only used to generate the UAP more effectively (faster). This update procedure terminates when the attack success rate for \(\mathbf{X}\) is 100%, or the number of iterations reaches the maximum \(i_{\text{max}}\).