# Empirical Perturbation Analysis of Two Adversarial Attacks: Black Box versus White Box
## 7 Penultimate Layer Activations with Adversarial Images
### How Are the CNNs' Classification Layers Affected by Adversarial Images?
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline  & \multicolumn{4}{c}{**(a)**} \\ \hline  & \multicolumn{2}{c}{**\(W_{pos}\)**} & \multicolumn{2}{c}{\(W_{neg}\)} \\ \cline{2-6}  & **For \(c_{a}\)** & **EA** & **BIM** & **EA** & **BIM** \\ \hline \(\mathcal{C}_{1}\) & DenseNet-121 & \(-\)0.02 \(\pm\) 0.07 & \(-\)0.05 \(\pm\) 0.09 & 0.17 \(\pm\) 0.05 & 0.21 \(\pm\) 0.06 \\ \hline \(\mathcal{C}_{2}\) & DenseNet-169 & 0.01 \(\pm\) 0.06 & \(-\)0.01 \(\pm\) 0.06 & 0.13 \(\pm\) 0.03 & 0.14 \(\pm\) 0.06 \\ \hline \(\mathcal{C}_{3}\) & DenseNet-201 & 0.00 \(\pm\) 0.05 & 0.00 \(\pm\) 0.06 & 0.09 \(\pm\) 0.04 & 0.12 \(\pm\) 0.04 \\ \hline \(\mathcal{C}_{4}\) & MobileNet & \(-\)0.09 \(\pm\) 0.10 & \(-\)0.05 \(\pm\) 0.16 & 0.18 \(\pm\) 0.06 & 0.26 \(\pm\) 0.10 \\ \hline \(\mathcal{C}_{5}\) & MNASNet & \(-\)0.01 \(\pm\) 0.07 & 0.02 \(\pm\) 0.09 & 0.12 \(\pm\) 0.04 & 0.18 \(\pm\) 0.09 \\ \hline \(\mathcal{C}_{6}\) & ResNet-50 & \(-\)0.02 \(\pm\) 0.07 & \(-\)0.05 \(\pm\) 0.09 & 0.17 \(\pm\) 0.05 & 0.20 \(\pm\) 0.08 \\ \hline \(\mathcal{C}_{7}\) & ResNet-101 & 0.00 \(\pm\) 0.07 & \(-\)0.04 \(\pm\) 0.15 & 0.21 \(\pm\) 0.05 & 0.25 \(\pm\) 0.10 \\ \hline \(\mathcal{C}_{8}\) & ResNet-152 & \(-\)0.02 \(\pm\) 0.07 & \(-\)0.06 \(\pm\) 0.07 & 0.21 \(\pm\) 0.04 & 0.22 \(\pm\) 0.04 \\ \hline \(\mathcal{C}_{9}\) & VGG-16 & \(-\)0.14 \(\pm\) 0.15 & \(-\)0.16 \(\pm\) 0.20 & 0.20 \(\pm\) 0.05 & 0.23 \(\pm\) 0.10 \\ \hline \(\mathcal{C}_{10}\) & VGG-19 & \(-\)0.09 \(\pm\) 0.08 & \(-\)0.17 \(\pm\) 0.12 & 0.21 \(\pm\) 0.06 & 0.20 \(\pm\) 0.07 \\ \hline \hline \end{tabular}
\begin{tabular}{c c c c c c} \hline \hline  & \multicolumn{4}{c}{**(b)**} \\ \cline{2-6}  & **For \(c_{t}\)** & **\(W_{pos}\)** & \multicolumn{2}{c}{\(W_{neg}\)} \\ \cline{2-6}  & **EA** & **BIM** & **EA** & **BIM** \\ \hline \(\mathcal{C}_{1}\) & DenseNet-121 & 0.27 \(\pm\) 0.08 & 0.30 \(\pm\) 0.10 & \(-\)0.06 \(\pm\) 0.06 & \(-\)0.07 \(\pm\) 0.08 \\ \hline \(\mathcal{C}_{2}\) & DenseNet-169 & 0.18 \(\pm\) 0.05 & 0.20 \(\pm\) 0.09 & \(-\)0.02 \(\pm\) 0.05 & \(-\)0.03 \(\pm\) 0.05 \\ \hline \(\mathcal{C}_{3}\) & DenseNet-201 & 0.15 \(\pm\) 0.05 & 0.17 \(\pm\) 0.05 & \(-\)0.02 \(\pm\) 0.03 & \(-\)0.03 \(\pm\) 0.04 \\ \hline \(\mathcal{C}_{4}\) & MobileNet & 0.27 \(\pm\) 0.06 & 0.38 \(\pm\) 0.14 & \(-\)0.16 \(\pm\) 0.08 & \(-\)0.15 \(\pm\) 0.11 \\ \hline \(\mathcal{C}_{5}\) & MNASNet & 0.19 \(\pm\) 0.05 & 0.28 \(\pm\) 0.12 & \(-\)0.06 \(\pm\) 0.06 & \(-\)0.06 \(\pm\) 0.07 \\ \hline \(\mathcal{C}_{6}\) & ResNet-50 & 0.30 \(\pm\) 0.11 & 0.32 \(\pm\) 0.14 & \(-\)0.04 \(\pm\) 0.04 & \(-\)0.05 \(\pm\) 0.06 \\ \hline \(\mathcal{C}_{7}\) & ResNet-101 & 0.35 \(\pm\) 0.08 & 0.39 \(\pm\) 0.17 & \(-\)0.03 \(\pm\) 0.05 & \(-\)0.04 \(\pm\) 0.07 \\ \hline \(\mathcal{C}_{8}\) & ResNet-152 & 0.33 \(\pm\) 0.05 & 0.35 \(\pm\) 0.09 & \(-\)0.03 \(\pm\) 0.04 & \(-\)0.05 \(\pm\) 0.04 \\ \hline \(\mathcal{C}_{9}\) & VGG-16 & 0.29 \(\pm\) 0.14 & 0.35 \(\pm\) 0.28 & \(-\)0.14 \(\pm\) 0.06 & \(-\)0.17 \(\pm\) 0.07 \\ \hline \(\mathcal{C}_{10}\) & VGG-19 & 0.33 \(\pm\) 0.10 & 0.29 \(\pm\) 0.18 & \(-\)0.13 \(\pm\) 0.05 & \(-\)0.17 \(\pm\) 0.04 \\ \hline \hline \end{tabular}
\end{table} 
Table 7: For \(c_{a}\) (a) and \(c_{t}\) (b), average and standard deviation of the activation change in the positively related (\(W_{pos}\), column 2) and negatively related (\(W_{neg}\), column 3) units.