## 3 The Proposed Method
### Adversarial Example Generation  
The adversarial perturbations are encoded as vectors (candidate solutions) and optimized by differential evolution algorithm. Each candidate solution contains a predefined number of perturbed pixels. Fore example, in a one-pixel attack, the number of perturbed pixels is 1. Each perturbed pixel has the modification value (one value in gray image, or three values of R, G and B in color image) and the coordinates \((x,y)\). The random numbers obeying normal distribution \(N(\mu=128,\sigma=127)\) are the initial R, G, and B values of perturbed pixels; each solution can be represented as a vector \((x,y,R,G,B)\). The initial population has 400 candidate solutions. In each iteration, an additional 400 offspring candidate solutions are produced. The differential evolution formula is  
\[\begin{split} x_{i}(t+1)=x_{r1}(t)+F\big{(}x_{r2}(t)-x_{r3}(t) \big{)},\\ \text{where }r1\
eq r2\
eq r3\end{split} \tag{1}\]  
where \(x_{i}\) represents a candidate solution, i.e., the \(i\)-th perturbed pixel. \(t\) denotes the iteration count, and \(F\) is a scaling coefficient with a preset value 0.5, which restricts \(x_{r1}(t),x_{r2}(t)\), and \(x_{r3}(t)\). \(r1,r2\), and \(r3\) are three random indices of the selected parent individuals that produce the offspring individuals. Once the offspring individuals are produced, all of the offspring individuals and their parents are evaluated together, and the 400 individuals with higher likelihoods of survival (higher fitness values) are selected and preserved. Small size hinders the objective function from finding the ideal optimal solution, while large size increases the computation time. A size of 400 is sufficient to find good optimal solutions in most images, and the computational complexity is acceptable.  
The image sizes of some datasets, e.g., ImageNet, are large. This can also be extended to multi-pixel attacks, where the number of perturbed pixels is larger than 1. This does not imply that altering just one pixel cannot execute an attack. If the computation is sufficient, i.e., the epoch number is large, even perturbing a single pixel can lead to a successful attack. In the case of \(n\)-pixel attack, RAE is fast, i.e., the epoch number is small, and each solution can be represented as a vector \((x_{1},y_{1},\)\(R_{1},\)\(G_{1},\)\(B_{1},\)\(x_{2},\)\(y_{2},\)\(R_{2},\)\(G_{2},\)\(B_{2},\)\(\ldots,\)\(x_{n},y_{n},\)\(R_{n},\)\(G_{n},\)\(B_{n})\). Algorithm 1 presents the workflow for generating adversarial perturbation using differential evolution.  
```
1:Input:
* Image \(I\)
* Population size \(N=400\)
* Number of pixels to perturb \(n\)
* Scaling factor \(F=0.5\)
* Maximum iterations \(T\)
2:Initialize:
* Population \(P\) of size \(N\)
* For 1-pixel attack: Each solution \(x_{i}=(x,y,R,G,B)\)
* For \(n\)-pixel attack: Each solution \(x_{i}=(x_{1},y_{1},R_{1},G_{1},B_{1},\ldots,x_{n},y_{n},R_{n},G_{n},B_{n})\)
* Initialize pixel values from \(N(\mu=128,\sigma=127)\)
3:for\(t=1\)to\(T\)do
4: # Mutation Phase
5:for each solution \(x_{i}\) in \(P\)do
6: Randomly select unique \(r_{1},r_{2},r_{3}\) from \(P\)
7:\(x_{i}(t+1)\gets x_{r_{1}}(t)+\hat{F}\cdot(x_{r_{2}}(t)-x_{r_{3}}(t))\)
8:endfor
9: # Crossover and Selection
10:\(Combined\_Population\gets P+Offspring\_Population\)
11: Evaluate fitness of all solutions
12: Select top 400 solutions with highest fitness
13: Update \(P\)
14:endfor
15:Return: best solution
```  
**Algorithm 1** Differential evolution for adversarial perturbation.