# Empirical Perturbation Analysis of Two Adversarial Attacks: Black Box versus White Box
## 6 Transferability of the Adversarial Noise at Smaller Image Regions
### Generic versus Specific Direction of the Adversarial Noise  
One is given a convenient ancestor image \(\mathcal{A}_{q}^{p}\), a CNN \(\mathcal{C}_{k}\), and the adversarial images \(\mathcal{D}_{k}^{EA}(\mathcal{A}_{q}^{p})\) and \(\mathcal{D}_{k}^{BIM}(\mathcal{A}_{q}^{p})\) obtained by both attacks.  
We perform the first series of experiments, which consists of changing the adversarial noise magnitude of these adversarial images by a factor \(f\) in the 0-300% range and of submitting the corresponding modified \(f\)-boosted adversarial images to different \(\mathcal{C}_{i}\)s to check whether they fool them.  
Figure 7a shows what happens for the particular case of \(\mathcal{A}_{5}^{4}\), \(k=6\), and to the \(\mathcal{C}_{i}\)s equal to \(\mathcal{C}_{1},\mathcal{C}_{6}\), and \(\mathcal{C}_{9}\) (the \(f\)-boosted adversarial image is sent back to \(\mathcal{C}_{6}\) as well), representative of the general behavior. In particular, it shows that the direction of the noise created for the EA adversarials is highly specific to the targeted CNN since the images cannot be made transferable by any change in magnitude. _A contrario_, the noise of BIM's adversarials has a more general direction, since amplifying its magnitude eventually leads to untargeted misclassifications by other CNNs.  
A second series of experiments is performed in a similar manner as above, with the difference that, this time, it is on the shuffled adversarial images \(sh(\mathcal{D}_{k}^{EA}(\mathcal{A}_{q}^{p}),s)\) and \(sh(\mathcal{D}_{k}^{BIM}(\mathcal{A}_{q}^{p}),s)\) for \(s=32\), \(56\), or \(112\).  
Figure 7b-d show the typical outcome of this experiment. It reveals another difference between the adversarial noise obtained by the two attacks, namely, when \(s\) is increased from \(32\) to \(56\) and \(112\), BIM images have a higher adversarial effect on other CNNs, whereas the EA images only have a higher adversarial effect when \(s\) is increased from \(32\) to \(56\). As the size of the shuffled boxes increases to \(s=112\) and reveals the ancestor object more clearly, the EA adversarials actually have a lower fooling effect on other CNNs.  
Moreover, in contrast to Figure 7a, where the considered region is at full scale, i.e., coincides with the full image size, Figure 7b-d show that the noise direction is more general at the local level and that an amplification of the noise magnitude is able to lead the adversarial images outside of other CNNs' \(c_{a}\) bounds, even with the EA.  
To ensure that the observed effects were not simply due to shuffling but were also due to the adversarial noise, we repeated the experiment shown in Figure 7 with random normal noise. As expected, it turned out that, with random noise, the \(c_{a}\)-label value always remained dominant and the \(c_{t}\)-label value barely increased as \(f\) varied from \(0\%\) to \(300\%\) (see Figure A6 in Appendix B.2). The close-to-zero impact of random noise on unshuffled images was already known [39]. These experiments confirm that this also holds true for shuffled images. Therefore, the observed effects were indeed due to the adversarial noise's transferability at the local level. Nevertheless, although the adversarial noise is general enough to affect other CNNs' \(c_{a}\)-label values, its effect on \(c_{t}\)-label values is never as strong as for the targeted CNN.