# Empirical Perturbation Analysis of Two Adversarial Attacks: Black Box versus White Box
## 8 Conclusions  
Through the lenses of frequency, transferability, texture change, smaller image regions, and penultimate layer activations, this study investigates the properties that make an image adversarial against a CNN. For this purpose, we consider a white-box, gradient-based attack and a black-box, evolutionary algorithm-based attack that create adversarial images fooling 10 ImageNet-trained CNNs. This study, which is performed using 84 original images and two groups of 437 adversarial images (one group per attack), provides an insight into the internal functioning of the considered attacks.  
The main outcomes are that the aggregation of features in smaller regions is generally insufficient for a targeted misclassification. We also find that image texture change is likely to be a side effect of the attacks rather than to play a crucial role, even though the EA and BIM adversarials are more likely to transfer to more texture-biased CNNs. While the lower part of the noise has the highest adversarial effect for both attacks, in contrast to the EA's white noise, BIM's mostly low-frequency noise impacts the local \(c_{a}\) features considerably more than the EA. This effect intensifies at larger image regions.  
In the penultimate CNN layers, neither the EA nor BIM affect the features that are positively related to \(c_{a}\). However, BIM's gradient-based nature allows it to find noise directions that are more general across different CNNs, introducing more features that are negatively related to \(c_{a}\) and that are perceivable by other CNNs as well. Nevertheless, with both attacks, the \(c_{t}\)-related adversarial noise that targets the final CNN layers is specific to the targeted CNN when the adversarial images are at full scale. On the other hand, its adversarial impact on other CNNs increases when the considered region is reduced from full scale to \(56\times 56\).  
This study can be pursued in many ways, with the most natural one being its expansion to other attacks such as the gradient-based PGD attack [7] and the score-based square attack [12]. Furthermore, the study of the CNN penultimate layer activations could be expanded to the intermediate layers, to visualize how the activation paths differ between clean and adversarial images. Another idea towards an improved CNN explainability would be to design methods for a small-dimensional visualization of the CNNs' decision boundaries to better assess how adversarial images cross these boundaries. Another research direction is to use the shuffling process described in this study to detect the existence of an attack and to separate adversarial images from clean images.  
R.C., A.O.T., F.L.: writing--review and editing. All authors have read and agreed to the published version of the manuscript.  
This research received no external funding.  
Figure A2: The 84 convenient ancestor images \(\mathcal{A}_{q}^{p}\) used in the experiments, for which both the EA and BIM created 0.999-strong adversarial images \(\mathcal{D}_{k}^{EA}(\mathcal{A}_{q}^{p})\) and \(\mathcal{D}_{k}^{BIM}(\mathcal{A}_{q}^{p})\).