# Empirical Perturbation Analysis of Two Adversarial Attacks: Black Box versus White Box
## 7 Penultimate Layer Activations with Adversarial Images
### How Are the CNNs' Classification Layers Affected by Adversarial Images?
\begin{table}
\begin{tabular}{l l c c c c c c c c c c c} \hline \hline \multicolumn{2}{c}{} & \multicolumn{2}{c}{\(W_{pos}\Delta_{pos}\)} & \multicolumn{2}{c}{\(W_{pos}\Delta_{0}\)} & \multicolumn{2}{c}{\(W_{pos}\Delta_{neg}\)} & \multicolumn{2}{c}{\(W_{neg}\Delta_{pos}\)} & \multicolumn{2}{c}{\(W_{neg}\Delta_{0}\)} & \multicolumn{2}{c}{\(W_{neg}\Delta_{neg}\)} \\ \cline{2-13} \multicolumn{2}{c}{} & **EA** & **BIM** & **EA** & **BIM** & **EA** & **BIM** & **EA** & **BIM** & **EA** & **BIM** & **EA** & **BIM** \\ \hline \(\mathcal{C}_{1}\) & DenseNet-121 & 70.06 & 67.06 & 0.04 & 0.04 & 29.90 & 32.90 & 50.00 & 50.30 & 0.12 & 0.10 & 49.89 & 49.60 \\ \hline \(\mathcal{C}_{2}\) & DenseNet-169 & 64.88 & 64.26 & 0.03 & 0.03 & 35.09 & 35.72 & 49.32 & 48.95 & 0.11 & 0.05 & 50.58 & 51.01 \\ \hline \(\mathcal{C}_{3}\) & DenseNet-201 & 64.72 & 63.61 & 0.08 & 0.06 & 35.21 & 36.32 & 48.80 & 48.52 & 0.05 & 0.03 & 51.15 & 51.45 \\ \hline \(\mathcal{C}_{4}\) & MobileNet & 69.74 & 71.62 & 0.52 & 0.31 & 29.74 & 28.07 & 38.13 & 42.25 & 1.24 & 0.74 & 60.63 & 57.01 \\ \hline \(\mathcal{C}_{5}\) & MNASNet & 64.51 & 66.94 & 5.60 & 3.50 & 29.89 & 29.56 & 42.75 & 45.32 & 8.13 & 6.23 & 49.12 & 48.44 \\ \hline \(\mathcal{C}_{6}\) & ResNet-50 & 75.16 & 73.24 & 0.01 & 0.00 & 24.82 & 26.76 & 46.29 & 47.73 & 0.03 & 0.00 & 53.69 & 52.27 \\ \hline \(\mathcal{C}_{7}\) & ResNet-101 & 77.68 & 74.77 & 0.01 & 0.00 & 22.31 & 25.23 & 48.16 & 48.78 & 0.05 & 0.02 & 51.79 & 51.20 \\ \hline \(\mathcal{C}_{8}\) & ResNet-152 & 75.37 & 73.43 & 0.00 & 0.00 & 24.63 & 26.57 & 48.21 & 48.39 & 0.01 & 0.00 & 51.78 & 51.61 \\ \hline \(\mathcal{C}_{9}\) & VGG-16 & 35.62 & 31.40 & 52.69 & 55.55 & 11.70 & 13.04 & 12.51 & 9.81 & 70.75 & 72.61 & 16.74 & 17.58 \\ \hline \(\mathcal{C}_{10}\) & VGG-19 & 35.35 & 32.82 & 53.13 & 53.65 & 11.52 & 13.53 & 12.13 & 10.51 & 70.80 & 71.31 & 17.06 & 18.17 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: For \(c_{t}\), average percentage of both positively related (\(W_{pos}\), columns 2–4) and negatively related (\(W_{neg}\), columns 5–7) units in which the activation increased (\(\Delta_{pos}\)), stagnated (\(\Delta_{0}\)), or decreased (\(\Delta_{neg}\)). \begin{table}
\begin{tabular}{l l c c c c c c c c c c c} \hline \hline \multicolumn{2}{c}{} & \multicolumn{2}{c}{\(W_{pos}\Delta_{pos}\)} & \multicolumn{2}{c}{\(W_{pos}\Delta_{0}\)} & \multicolumn{2}{c}{\(W_{pos}\Delta_{neg}\)} & \multicolumn{2}{c}{\(W_{neg}\Delta_{pos}\)} & \multicolumn{2}{c}{\(W_{neg}\Delta_{0}\)} & \multicolumn{2}{c}{\(W_{neg}\Delta_{neg}\)} \\ \cline{2-13} \multicolumn{2}{c}{} & **EA** & **BIM** & **EA** & **BIM** & **EA** & **BIM** & **EA** & **BIM** & **EA** & **BIM** \\ \hline \(\mathcal{C}_{1}\) & DenseNet-121 & 51.28 & 48.83 & 0.02 & 0.04 & 48.70 & 51.13 & 65.36 & 65.19 & 0.13 & 0.09 & 34.51 & 34.72 \\ \hline \(\mathcal{C}_{2}\) & DenseNet-169 & 49.03 & 49.26 & 0.03 & 0.03 & 50.95 & 50.72 & 62.42 & 61.13 & 0.11 & 0.05 & 37.47 & 38.82 \\ \hline \(\mathcal{C}_{3}\) & DenseNet-201 & 49.48 & 48.66 & 0.07 & 0.03 & 50.45 & 51.31 & 61.04 & 60.45 & 0.06 & 0.06 & 38.90 & 39.49 \\ \hline \(\mathcal{C}_{4}\) & MobileNet & 43.73 & 46.59 & 0.46 & 0.31 & 55.81 & 53.10 & 62.64 & 65.80 & 1.24 & 0.71 & 36.12 & 33.48 \\ \hline \(\mathcal{C}_{5}\) & MNASNet & 47.64 & 49.93 & 4.81 & 3.43 & 47.55 & 46.64 & 58.34 & 61.04 & 8.77 & 6.17 & 32.89 & 32.79 \\ \hline \(\mathcal{C}_{6}\) & ResNet-50 & 45.80 & 45.61 & 0.02 & 0.00 & 54.17 & 54.39 & 65.86 & 66.11 & 0.02 & 0.00 & 34.13 & 33.89 \\ \hline \(\mathcal{C}_{7}\) & ResNet-101 & 48.26 & 46.05 & 0.01 & 0.00 & 51.73 & 53.95 & 67.63 & 67.75 & 0.05 & 0.02 & 32.32 & 32.23 \\ \hline \(\mathcal{C}_{8}\) & ResNet-152 & 46.84 & 45.56 & 0.00 & 0.00 & 53.16 & 54.44 & 67.18 & 66.92 & 0.01 & 0.00 & 32.81 & 33.08 \\ \hline \(\mathcal{C}_{9}\) & VGG-16 & 23.67 & 19.64 & 50.63 & 52.98 & 25.71 & 27.39 & 22.08 & 19.15 & 72.5 These observations are consistent with the results of Table 7, which show that the average activation changes are large and positive for (\(W_{neg}\),\(c_{a}\)) and (\(W_{pos}\),\(c_{t}\)) for both attacks.