Original: O NE FOR M ANY : AN I NSTAGRAM INSPIRED BLACKBOX ADVERSARIAL ATTACK
Revised: O NE FOR M ANY : AN I NSTAGRAM INSPIRED BLACKBOX ADVERSARIAL ATTACK

Original: Anonymous authors
Revised: Anonymous authors

Original: Paper under double-blind review
Revised: Paper under double-blind review

Original: A BSTRACT
Revised: A BSTRACT

Original: It is well known that deep learning models are susceptible to adversarial attacks.

Original: To produce more robust and effective attacks, we propose a nested evolutionary algorithm able to produce multi-network (decision-based) black-box adversarial attacks based on Instagram inspired image ﬁlters.
Revised: We propose a nested evolutionary algorithm able to craft multi-network (decisionbased) black-box adversarial attacks based on Instagram inspired image filters.

Original: Due to the multi-network training, the system reaches a high transferability rate of attacks and, due to the composition of image ﬁlters, it is able to bypass standard detection mechanisms.
Revised: Due to the multi-network training the system reaches a high transferability rate of attacks and, due to the composition of image filters it is able to bypass standard detection mechanisms.

Original: Moreover, this kind of attack is semantically robust: our ﬁlter composition cannot be distinguished from any other ﬁlter composition used extensively every day to enhance images; this raises new security issues and challenges for real-world systems.
Revised: Moreover, this kind of attack is semantically robust: our filter composition cannot be distinguished from any other filter composition used extensively every day to enhance images; this raises new security issues and challenges for real-world systems.

Original: Experimental results demonstrate that the method is also effective against ensemble-adversarially trained models and it has a low cost in terms of queries to the victim model.
Revised: Experimental results demonstrate that the method is also effective against ensemble-adversarially trained models and it has a low cost in terms of queries to the victim model

Original:  I NTRODUCTION
Revised:  I NTRODUCTION

Original: It is well known that deep learning models are susceptible to adversarial attacks and many recent researches in the ﬁeld have been devoted to produce ever more reliable and effective attacks.
Revised: It is well known that deep learning models are susceptible to adversarial attacks and many recent researches in the field have been devoted to produce ever more reliable and effective attacks.

Original: Attack reliability is strictly connected to its applicability in real-world scenarios and to its ability to bypass potential defense mechanisms; this is why the hard-label black-box setting (also called decisionbased attack) and the transferability property of white box attacks gained increasing attention.
Revised: Attack reliability is strictly connected to its applicability in real-world scenarios and to its ability to bypass potential defense mechanisms; this is why the hard-label black-box setting (also called decisionbased attack) and the transferability property of white box attacks gained increasing attention.

Original: Several techniques have been proposed to increase the transferability of both black-box and white-box attacks (Cheng et al.
Revised: Several techniques have been proposed to increase the transferability of both black-box and white-box attacks (Cheng et al.

Original: ; Wu et al.
Revised: ; Wu et al.

Original: Brendel et al.
Revised: Brendel et al.

Original: (2018) , among the most popular).
Revised: (2018) , among the most popular).

Original: One of the most commonly adopted technique is to craft the attacks by using an ensemble of multiple models as proposed by Liu et al.
Revised: One of the most commonly adopted technique is to craft the attacks by using an ensemble of multiple models as proposed by Liu et al.

Original: Moreover, these studies also led to the discovery of surprising properties of Deep Neural Networks exposing important weakness about network architectures, as is the case of skip connections (Wu et al., 2020).

Original: Besides the categorization in white-box and black-box methods, attacks can be classiﬁed as restricted or unrestricted , considering the amount of modiﬁcations they apply to the images in order to fool the systems.
Revised: Besides the categorization in white-box and black-box methods, attacks can be classified as restricted or unrestricted , considering the amount of modifications they apply to the images in order to fool the systems.

Original: Restricted attacks: they generally use a L p -norm distance to bound the modiﬁcations.
Revised: Restricted attacks: they generally use a L p -norm distance to bound the modifications.

Original: The attacks are crafted with the aim of minimizing the differences between the original image and the adversarial one, even if it means having visible (more or less) artifacts.
Revised: The attacks are crafted with the aim of minimizing the differences between the original image and the adversarial one, even if it means having visible (more or less) artifacts.

Original: In Figures 1b and 1d, the attacks produced by Dong et al.
Revised: In Figures 1b and 1d, the attacks produced by Dong et al.

Original: and Wu et al.
Revised: and Wu et al.

Original: (2020), two of the most recent state-of-the-art adversarial methods, are shown.
Revised: (2020), two of the most recent state-of-the-art adversarial methods, are shown.

Original: In both the cases the generated artifacts are clearly visible.
Revised: In both the cases the generated artifacts are clearly visible.

Original: Unrestricted attacks: they employ large and visible perturbations while keeping the images realistic, natural looking and non-suspicious.
Revised: Unrestricted attacks: they employ large and visible perturbations while keeping the images realistic, natural looking and non-suspicious.

Original: The idea is to obtain images that can admit great differences from the original one but, beyond a direct comparison with the original one they cannot be distinguished from any other real (maybe ﬁltered) image.
Revised: The idea is to obtain images that can admit great differences from the original one but, beyond a direct comparison with the original one they cannot be distinguished from any other real (maybe filtered) image.

Original: In Figures 1f and 1h, the attacks produced by
Revised: In Figures 1f and 1h, the attacks produced by

Original: ACE-Ins (Zhao et al., 2020) and Colorfool (Shahin Shamsabadi et al., 2020) are shown.
Revised: ACE-Ins (Zhao et al., 2020) and Colorfool (Shahin Shamsabadi et al., 2020) are shown.

Original: The differences between the original image and the adversarial one are evident but, if the modiﬁcations are good enough, looking just at the adversarial one we might not be able to say that it is the attacking one.
Revised: The differences between the original image and the adversarial one are evident but, if the modifications are good enough, looking just at the adversarial one we might not be able to say that it is the attacking image.

Original: Another aspect that has to be taken into account for real-world attacks is the amount of queries to the victim model that are necessary to craft effective attacks.
Revised: Another aspect that has to be taken into account for real-world attacks is the amount of queries to the victim model that are necessary to craft effective attacks.

Original: All the systems proposed in literature need a huge amount of queries and, also in the case of systems built to work with limited access to 
Revised: All the systems proposed in literature need a huge amount of queries and, also in the case of systems built to work with limited access to the victim model, several thousands of queries are needed to produce reliable attacks. In this paper we propose a system to craft reliable, effective and highly transferable attacks by composing image filters. In previous papers (for ex. Destylization) has been shown that Instagram

Original: [Figure]
Revised: [Figure]

Original: the victim model, some thousands of queries are needed to produce reliable attacks.
Revised: inspired filters can have adversarial, but limited effects, when applied singularly.

Original: For example, the state-of-the-art Sign-OPT and QEBA attacks, very efﬁcient in terms of number of queries also in the hard-label black box setting, requires respectively 30k and 20k accesses to  the victim model to reach signiﬁcant success rates (Cheng et al., 2020; Li et al., 2020) against ResNet50 and ResNet on the ImageNet dataset.
Revised: Hence, we decided to study the effects of filter composition with the aim to increase the adversarial effectiveness.

Original: In this paper we propose a system to craft reliable, effective and highly transferable attacks by composing image ﬁlters. This kind of attack offers multiple beneﬁts: (i) it is naturally robust to detecting methods able to ﬁnd noise, injected patterns and irregularities in the high frequencies image (Moosavi-Dezfooli et al., 2018;
Revised: Moreover, in the usual photo editing process people use more than one filter in order to obtain the desired effect. We just wanted to simulate a more realistic scenario. This kind of attack offers multiple benefits: (i) it is naturally robust to detecting methods able to find noise, injected patterns and irregularities in the high frequencies image (Moosavi-Dezfooli et al., 2018;

Original: Liao et al., 2018).
Revised: Liao et al., 2018).

Original: (ii) it is naturally robust to masking-gradients (and their numerical estimate) defending methods.
Revised: (ii) it is naturally robust to masking-gradients (and their numerical estimate) defending methods.

Original: (iii) it produces natural looking artifacts-free images.
Revised: (iii) it produces natural looking artifacts-free images.

Original: (iv) it produces adversarial attacks that cannot be distinguished from any other ﬁltered images produced extensively every day, especially on social media platforms.
Revised: (iv) it produces adversarial attacks that cannot be distinguished from any other filtered images produced extensively every day, especially on social media platforms.

Original: The system works in the pure hard-label black box setting and implements a multi-network approach to increase the attack transferability.
Revised: The system works in the pure hard-label black box setting and implements a multi-network approach to increase the attack transferability.

Original: It can reach, with artifact-free images, a transferability rate higher than 70% in the case of unsecured networks and, even more interestingly, higher than 60% in the case of adversarially trained network.
Revised: It can reach, with artifact-free images, a transferability rate higher than 70% in the case of unsecured networks and, even more interestingly, higher than 60% in the case of adversarially trained network.

Original: Moreover, the system requires a very low number of queries to ﬁnd an attack, around 640 in the average case, and it can be limited by construction adjusting the algorithm parameters.
Revised: Moreover, the system requires a very low number of queries to find an attack, around 640 in the average case, and it can be limited by construction adjusting the algorithm parameters.

Original: In the experiments presented here the maximum number of allowed queries is 1610.
Revised: In the experiments presented here the maximum number of allowed queries is 1610.

Original: Our contribution can be summarized as follows: 
Revised: Our contribution can be summarized as follows: (i)

Original: • we propose the AGV-multinetwork attack, a system able to craft powerful adversarial attacks capable of attacking even secured adversarially trained models by composing Instagram inspired image ﬁlters • we empirically demonstrate the high transferability of these attacks and we compare our results with other state-of-the-art systems. • we empirically demonstrate the efﬁciency of our system in terms of queries to the victim model and we compare our results with other state-of-the-art systems.
Revised: We propose the AGV-multinetwork attack, a system able to craft powerful adversarial attacks capable of attacking even secured adversarially trained models by composing Instagram inspired image filters; (ii) we empirically demonstrate the high transferability of these attacks and we compare our results with other state-of-the-art systems; (iii) we empirically demonstrate the efficiency of our system in terms of queries to the victim model and we compare our results with other state-of-the-art systems.

Original:  B ACKGROUND 2. A DVERSARIAL M ACHINE L EARNING
Revised:  B ACKGROUND 2. A DVERSARIAL M ACHINE L EARNING

Original: Given an input image x ∈ X ⊂ R d and its corresponding label y , let F be a neural network classiﬁer that (correctly) predicts the class label for the input image x : F ( x ) =
Revised: Given an input image x ∈ X ⊂ R d and its corresponding label y , let F be a neural network classifier that (correctly) predicts the class label for the input image x : F ( x ) =

Original: y .
Revised: y .

Original: An adversarial attack attempts to modify the input image x by adding a perturbation δ into an adversarial image x ∗
Revised: An adversarial attack attempts to modify the input image x by adding a perturbation δ into an adversarial image x ∗

Original: = x
Revised: = x

Original: + δ such that the classiﬁer is mislead into making a wrong prediction, i.e. F ( x ∗ ) (cid:54) = F ( x ) .
Revised: + δ such that the classifier is mislead into making a wrong prediction, i.e. F ( x ∗ ) ̸ = F ( x ) .

Original: If we consider the type of the applied perturbation δ , the attacks can be classiﬁed as restricted or unrestricted.
Revised: If we consider the type of the applied perturbation δ , the attacks can be classified as restricted or unrestricted.

Original: In the restricted case, the modiﬁcations applied to the original image are usually small and bounded by a L p -norm distance measure, forcing the adversarial image x ∗ to be as close as possible to the original one.
Revised: In the restricted case, the modifications applied to the original image are usually small and bounded by a L p -norm distance measure, forcing the adversarial image x ∗ to be as close as possible to the original one.

Original: On the contrary, unrestricted attacks use large perturbations without
Revised: On the contrary, unrestricted attacks use large perturbations without

Original: L p -bounded constraints that manipulate the image in order to create photo-realistic adversarial examples.
Revised: L p -bounded constraints that manipulate the image in order to create photo-realistic adversarial examples.

Original: In this case the objective is not to limit the modiﬁcations on pixels but limit the human perception that a modiﬁcation has been applied (Shahin Shamsabadi et al., 2020; Zhao et al.
Revised: In this case the objective is not to limit the modifications on pixels but limit the human perception that a modification has been applied (Shahin Shamsabadi et al., 2020; Zhao et al.

Original: ; Wang et al., 2021).
Revised: ; Wang et al., 2021).

Original: 2. I MAGE F ILTERS
Revised: 2. I MAGE F ILTERS

Original: Photo editing has become a common practice in many business areas and particularly on social media sites where image enhancement and manipulation are extensively and excessively used.

Original: Inspired by Instagram, which offers tools to seamlessly modify images, we propose to combine multiple image ﬁlters in order to create custom adversarial image transformations.

Original: This approach provides plenty styles options, ranging from subtle and warm looks to more dramatic and vivid colors effects.

Original: Therefore, we implemented ten of the most popular Instagram ﬁlters using Python3 and the Pillow, OpenCV and Numpy libraries: Clarendon, Juno, Reyes, Gingham, Lark, Hudson, Slumber, Stinson, Rise, and Perpetua .
Revised: We implemented ten of the most popular Instagram filters using Python3 and the Pillow, OpenCV and Numpy libraries: Clarendon, Juno, Reyes, Gingham, Lark, Hudson, Slumber, Stinson, Rise, and Perpetua .

Original: Each ﬁlter has distinct characteristics and effects given by different level of contrast, saturation, brightness, shadows, etc.
Revised: Each filter has distinct characteristics and effects given by different level of contrast, saturation, brightness, shadows, etc.

Original: For instance, Clarendon brightens and highlights a photo, Juno adds saturation and warmth making the colors more intense, Rise gives a warm glow by mixing a radial gradient with a light sepia tone, while Hudson bumps up the blues giving a more colder feel. 
Revised: For instance, Clarendon brightens and highlights a photo, Juno adds saturation and warmth making the colors more intense, Rise gives a warm glow by mixing a radial gradient with a light sepia tone, while Hudson bumps up the blues giving a more colder feel. Examples of single filter applications are shown in Figure 6 in Appendix A. .

Original: Each ﬁlter is parameterized by two parameters that have to be optimized by the algorithm: intensity α and strength s .
Revised: Each filter is parameterized by two parameters that have to be optimized by the algorithm: intensity α and strength s .

Original: The role of the parameter α is to alter the intensity of each basic component inside each ﬁlter implementation such as brightness, contrast, saturation, edge enhancement, gamma correction and many more.
Revised: The role of the parameter α is to alter the intensity of each basic component inside each filter implementation such as brightness, contrast, saturation, edge enhancement, gamma correction and many more.

Original: The parameter s is used to control the strength of the ﬁlter application and it is deﬁned as the convex interpolation between the original image x
Revised: The parameter s is used to control the strength of the filter application and it is defined as the convex interpolation between the original image x

Original: and the transformed image x ∗ : 
Revised: and the transformed image x ∗ : strength

Original: [Equation]
Revised: [Equation]

Original:  thus, if s = 0 the output image of the ﬁlter is the original image, while with s = 1 the ﬁlter returns the modiﬁed image x ∗ .
Revised: [Equation] thus, if s = 0 the output image of the filter is the original image, while with s = 1 the filter returns the modified image x ∗ .

Original:  A PPROACH AND A LGORITHM 3. P ROBLEM D EFINITION
Revised:  A PPROACH AND A LGORITHM 3. P ROBLEM D EFINITION

Original: Given a set S = { f 1 , f 2 , . . .
Revised: Given a set S = { f 1 , f 2 , . . .

Original: , f m } of Instagram inspired image ﬁlters as described in Section 2.2, and a clean image x , we want to ﬁnd a sequence of n parametrized ﬁlters { f k 1 ( α 1 , s 1 ) , . . .
Revised: , f m } of Instagram inspired image filters as described in Section 2.2, and a clean image x , we want to find a sequence of n parametrized filters { f k 1 ( α 1 , s 1 ) , . . .

Original: , f k n ( α n , s n ) } able to produce an adversarial attack against a classiﬁer model F starting from the image x , that is 
Revised: , f k n ( α n , s n ) } able to produce an adversarial attack against a classifier model F starting from the image x , that is [Equation]

Original: [Equation]
Revised: [Equation]

Original: 3. A PPROACH
Revised: A PPROACH

Original: The algorithm used to optimize the sequence of ﬁlters and their parameters is inspired by Baia et al.
Revised: The algorithm used to optimize the sequence of filters and their parameters is inspired by Baia et al.

Original: In our proposal the universal approach proposed by Baia et al. has been transformed into a multi-network per-image approach, where the attack is crafted and optimized for just one image with respect to more target models.
Revised: In our proposal the universal approach proposed by Baia et al. has been transformed into a multi-network per-image approach, where the attack is crafted and optimized for just one image with respect to more target models.

Original: Since the algorithm uses an evolutionary approach, the ﬁtness function used to guide the search can have any (also non differentiable) form, and we decide to use it to implement a sort of generalization ability induced by attacking more models simultaneously.
Revised: Since the algorithm uses an evolutionary approach, the fitness function used to guide the search can have any (also non differentiable) form, and we decide to use it to implement a sort of generalization ability induced by attacking more models simultaneously.

Original: This is inspired by Liu et al.
Revised: This is inspired by Liu et al.

Original: (2017) where the authors suggested that attacking an ensemble of multiple networks simultaneously can generate much stronger adversarial examples.
Revised: (2017) where the authors suggested that attacking an ensemble of multiple networks simultaneously can generate much stronger adversarial examples.

Original: Instead of attacking an ensemble network we decided to exploit the optmization ability of the evolutionary approach and try to simoultaneously attack all the (or at least k ) reference networks.
Revised: Instead of attacking an ensemble network we decided to exploit the optimization ability of the evolutionary approach and try to simultaneously attack all the (or at least k ) reference networks.

Original: Therefore, our goal is to ﬁnd one adversarial perturbation per-image that can fool many deep learning models.
Revised: Therefore, our goal is to find one adversarial perturbation per-image that can fool many deep learning models.

Original: This objective is much harder to achieve than attacking a single model but it guarantees complete (100%) transferability of the attack towards the reference networks.
Revised: This objective is much harder to achieve than attacking a single model but it guarantees complete (100%) transferability of the attack towards the reference networks.

Original: The proposed multi-network approach has the objective to obtain adversarial images with better transferability avoiding the natural overﬁtting trap we can fall into when the attacks are crafted by using a unique reference model.
Revised: The proposed multi-network approach has the objective to obtain adversarial images with better transferability avoiding the natural overfitting trap we can fall into when the attacks are crafted by using a unique reference model.

Original: 3. A LGORITHM
Revised: 3. A LGORITHM

Original: The optimization method consists of two evolutionary nested algorithms: the outer algorithm, using a GA approach, in charge of ﬁnding the sequence of ﬁlters to use, and the inner algorithm, based on ES, used to choose the ﬁlter parameter values.
Revised: The optimization method consists of two evolutionary nested algorithms: the outer algorithm, using a GA approach, in charge of finding the sequence of filters to use, and the inner algorithm, based on ES, used to choose the filter parameter values.

Original: The general structure of the multi-network algorithm is shown in Algorithm 1.
Revised: The general structure of the multi-network algorithm is shown in Algorithm 1.

Revised: Given a set S = { f 1 , f 2 , f m } of image filters, the outer algorithm genotype (with length n ) is encoded as a list of n integers k 1 , . . .

Revised: , k n ∈ { 1 , . .

Revised: . , m } representing the corresponding filters in S , while the inner algorithm genotype is represented by a list containing the pairs of parameters used for each selected filter (( α 1 , s 1 ) , . .

Revised: , ( α n , s n )) .

Revised: The associated phenotype is sequence of parametrized filters able to generate the adversarial examples by applying the selected sequence of filters, with their corresponding optimized parameters, as described in Eq.2.

Original: 3.3. O UTER A LGORITHM
Revised: 3.3. O UTER A LGORITHM

Original: The outer optimization step is performed by a genetic algorithm: a population of N candidate perturbations is iteratively evolved towards better solutions.
Revised: The outer optimization step is performed by a genetic algorithm: a population of N candidate perturbations is iteratively evolved towards better solutions.

Original: In order to breed a new generation, population members are randomly selected and the crossover and mutation operations are performed.
Revised: In order to breed a new generation, population members are randomly selected and the crossover and mutation operations are performed.

Original: The quality of the candidates is evaluated based on their ﬁtness values and, at the end of each iteration, the
Revised: The quality of the candidates is evaluated based on their fitness values and, at the end of each iteration, the

Original: N best individuals are chosen for the next generation.
Revised: N best individuals are chosen for the next generation.

Original: Initial population: it is generated by randomly selecting l ﬁlters from the set S of available ﬁlters and their parameters are initialized with default values equal to 1.
Revised: Initial population: it is generated by randomly selecting l filters from the set S of available filters and their parameters are initialized with default values equal to 1.

Original: Crossover: a standard one-point crossover is used to generate new off-springs from randomly selected members.
Revised: Crossover: a standard one-point crossover is used to generate new off-springs from randomly selected members.

Original: Each child is guaranteed to inherit some genetic information from both parents, including the optimized parameters.
Revised: Each child is guaranteed to inherit some genetic information from both parents, including the optimized parameters.

Revised: For example, given two parent elements P 1 = ( f ′ 1 ( α ′ 1 , s ′ 1 ) , . . .

Revised: , f ′ n ( α ′ n , s ′ n )) and P 2 = ( f ′′ 1 ( α ′′ 1 , s ′′ 1 ) , . . .

Revised: , f ′′ n ( α ′′ n , s ′′ n )) and crossover index i = 2 , we obtain the child element ( f ′ 1 ( α ′ 1 , s ′ 1 ) , f ′ 2 ( α ′ 2 , s ′ 2 ) , f ′′ 3 ( α ′′ 3 , s ′′ 3 ) , . . .

Revised: , f ′′ n ( α ′′ n , s ′′ n )) .

Original: Mutation: it is applied by substituting a ﬁlter with another one based on a mutation probability.
Revised: Mutation: it is applied by substituting a filter with another one based on a mutation probability.

Original: The substituent ﬁlter is initialized with random parameter values.
Revised: The substituent filter is initialized with random parameter values.

Revised: For example considering the element P = ( f 1 ( α 1 , s 1 ) , f 2 ( α 2 , s 2 ) , f 3 ( α 3 , s 3 ) . . .

Revised: , f n ( α n , s n )) and supposing that filters f 1 and f 3 has been chosen to mutate with g 1 and g 2 , the new generated element is P ∗ =

Revised: ( g 1 ( α ∗ 1 , s ∗ 1 ) , f 2 ( α 2 , s 2 ) , g 2 ( α ∗ 2 , s ∗ 2 ) . .

Revised: . , f n ( α n , s n )) , where α ∗ i , s ∗ i are randomly extracted from the parameter domains.

Original: Selection: at the end of each iteration, we choose the N best individuals from the set of 2N candidates (parents and offsprings) according to their ﬁtness values.
Revised: Selection: at the end of each iteration, we choose the N best individuals from the set of 2N candidates (parents and offsprings) according to their fitness values.

Original: This process is repeated until the algorithm exhausts the allowed number of generations.
Revised: This process is repeated until the algorithm exhausts the allowed number of generations.

Original: 3.3. I NNER A LGORITHM
Revised: 3.3. I NNER A LGORITHM

Original: This algorithm is devoted to the parameter optimization and is achieved by using (1 , λ ) evolution strategy with λ = 5 .
Revised: This algorithm is devoted to the parameter optimization and is achieved by using (1 , λ ) evolution strategy with λ = 5 .

Original: ES iteratively updates a search distribution by following the natural gradient towards higher expected ﬁtness.
Revised: ES iteratively updates a search distribution by following the natural gradient towards higher expected fitness.

Original: In our case, for each list of parameters we compute a batch of λ samples by perturbing the original individual.
Revised: In our case, for each list of parameters we compute a batch of λ samples by perturbing the original individual.

Original: A gradient towards a better solution is estimated using the ﬁtness values of the λ samples.
Revised: A gradient towards a better solution is estimated using the fitness values of the λ samples.

Original: This gradient is then used to update the original individual.
Revised: This gradient is then used to update the original individual.

Original: This process is repeated until the algorithm reaches the allowed number of iterations.
Revised: This process is repeated until the algorithm reaches the allowed number of iterations.

Original: 3. E VALUATION
Revised: 3. E VALUATION

Original: We deﬁne the ﬁtness function based on the attack success rate ( ASR ) since the objective of the algorithm is to fool image classiﬁcation systems.
Revised: We define the fitness function based on the attack success rate ( ASR ) since the objective of the algorithm is to fool image classification systems.

Original: In the case of multi-networks attacks we average the attack success rate values computed on multiple networks simultaneously.
Revised: In the case of multi-networks attacks we average the attack success rate values computed on multiple networks simultaneously.

Original: Speciﬁcally, given K F i neural networks models, a I legitimate image, and the corresponding perturbed image I ∗ obtained by applying the sequence of parametrized ﬁlters we want to evaluate, we deﬁned the multi-network ﬁtness function as:
Revised: Specifically, given K F i neural networks models, a I legitimate image, and the corresponding perturbed image I ∗ obtained by applying the sequence of parametrized filters we want to evaluate, we defined the multi-network fitness function as:

Original: [Equation]
Revised: [Equation]

Original: where ASR k represents the attack success rate calculated by querying the k -th target model: it returns 1 if F k ( I ) (cid:54) =
Revised: where ASR k represents the attack success rate calculated by querying the k -th target model: it returns 1 if F k ( I ) ̸

Original:  F k ( I ∗ ) , 0 otherwise with respect to the Top-1 prediction.
Revised: = F k ( I ∗ ) , 0 otherwise with respect to the Top-1 prediction.

Original: 3.4. A LLOWED Q UERIES
Revised: 3.4. A LLOWED Q UERIES

Original: The algorithm works with limited accesses to the victim model.
Revised: The algorithm works with limited accesses to the victim model.

Original: In our algorithm the victim model is called every time we have to compute the ﬁtness function.
Revised: In our algorithm the victim model is called every time we have to compute the fitness function.

Original: Besides the explicit calls to the evaluation function made in the initialization step and in the last step of each outer iteration, we have to consider the E in × N in calls made by the inner optimization phase (ﬁlters’ parameters optimization) for each element in the outer population.
Revised: Besides the explicit calls to the evaluation function made in the initialization step and in the last step of each outer iteration, we have to consider the E in × N in calls made by the inner optimization phase (filters’ parameters optimization) for each element in the outer population.

Original: The maximum number of allowed queries can be easily computed as:
Revised: The maximum number of allowed queries can be easily computed as:

Original: [Equation]
Revised: [Equation]

Original: Algorithm
Revised: The drawback of using an evolutionary approach is highly mitigated by the needed reduced number of generations and population size.

Original: Input : Image I , K classiﬁcation models, outer population size N out , inner population size
Revised: Input : Image I , K classification models, outer population size N out , inner population size

Original: N in ,number of outer generations E out , number of inner generations E in , obj the number of target models we want to attack.
Revised: N in ,number of outer generations E out , number of inner generations E in , obj the number of target models we want to attack.

Original: Initialize population P of N out individuals; foreach p ∈ P do
Revised: Initialize population P of N out individuals; foreach p ∈ P do

Original: Evaluate the ﬁtness of p by F K ; end e=0 ; while ( e < E out and F K · K < obj )
Revised: Evaluate the fitness of p by F K ; end e=0 ; while ( e < E out and F K · K < obj )

Original: do
Revised: do

Original: Offsprings = {∅} ; for i = 1 to N out do
Revised: Offsprings = {∅} ; for i = 1 to N out do

Original: Select randomly two parents p 1 , p 2 from P ; y i =
Revised: Select randomly two parents p 1 , p 2 from P ; y i =

Original: crossover( p 1 , p 2 );
Revised: crossover( p 1 , p 2 );

Original: y i = mutation( y i ) ; n  = ES optimizer ( y i , E in , N in ) ;
Revised: y i = mutation( y i ) ; n i = ES optimizer ( y i , E in , N in ) ;

Original: Offsprings ← ( n i ) ; endforeach o ∈ Offsprings do
Revised: Offsprings ← ( n i ) ; endforeach o ∈ Offsprings do

Original: Evaluate the ﬁtness of o by F K ; 
Revised: Evaluate the fitness of o by F K ; end

Revised: P = selection( P , Offsprings) ; e = e + 1 ; endreturn : best filter sequence for image I ;

Original:  E XPERIMENTS 4. E XPERIMENTAL SETUP
Revised:  E XPERIMENTS 4. E XPERIMENTAL SETUP

Original: Networks :
Revised: Networks :

Original: To validate the proposed method we employed ﬁve state-of-the-art neural networks for image classiﬁcation as reference models to ﬁnd the adversarial ﬁlter sequences, namely ResNet50,
Revised: To validate the proposed method we employed five state-of-the-art neural networks for image classification as reference models to find the adversarial filter sequences, namely ResNet50,

Original: VGG19, DenseNet201, MobileNet and NasNetMobile.
Revised: VGG19, DenseNet201, MobileNet and NasNetMobile.

Original: To evaluate the effectiveness of the transferability we use as hold-out models two normally trained networks, i.e. InceptionV3 and InceptionV4, and one adversarially trained network, i.e InceptionResNetV2-ens-adv (Tram`er et al., 2018).
Revised: To evaluate the effectiveness of the transferability we use as hold-out models two normally trained networks, i.e. InceptionV3 and InceptionV4, and one adversarially trained network, i.e InceptionResNetV2-ens-adv (Tram`er et al., 2018).

Original: Different architectures were chosen in order to explore the generalization capability of the algorithm given that these models are fundamental components of other deep learning models used for object detection and image segmentation.
Revised: Different architectures were chosen in order to explore the generalization capability of the algorithm given that these models are fundamental components of other deep learning models used for object detection and image segmentation.

Original: Besides,  MobileNet and NasNetMobile  are architectures often used in ML-powered mobile apps thanks to their low-latency and lightweight nature which makes them an interesting case study.
Revised: Besides, we decided to use MobileNet and NasNetMobile because they are architectures often used in ML-powered mobile apps thanks to their low-latency and lightweight nature which makes them an interesting case study.

Original: These models were trained on the large visual ImageNet training dataset (Deng et al., 2009) and they are publicly available.
Revised: These models were trained on the large visual ImageNet training dataset (Deng et al., 2009) and they are publicly available.

Original: Multi-network setup :
Revised: Multi-network setup :

Original: In the multi-network conﬁguration we simultaneously attack multiple deep learning models.
Revised: In the multi-network configuration we simultaneously attack multiple deep learning models.

Original: More speciﬁcally, we study three multi-network setups:
Revised: More specifically, we study three multi-network setups:

Original: • 5-NET : includes MobileNet, ResNet50, VGG19, DenseNet201, NasNetMobile • 4-NET : includes MobileNet, ResNet50, VGG19, DenseNet • 3-NET : includes MobileNet, ResNet50, VGG
Revised: • 5-NET : includes MobileNet, ResNet50, VGG19, DenseNet201, NasNetMobile • 4-NET : includes MobileNet, ResNet50, VGG19, DenseNet • 3-NET : includes MobileNet, ResNet50, VGG

Original: Dataset : We performed the experiments on a subset of 1000 images from the ImageNet validation dataset.
Revised: Dataset : We performed the experiments on a subset of 1000 images from the ImageNet validation dataset.

Original: The images were preprocessed according to the requirements of each pre-trained neural network.
Revised: The images were preprocessed according to the requirements of each pre-trained neural network.

Original: Implementations details.
Revised: Implementations details.

Original: The hyperparameters of the outer algorithm were set as follows: N out = 10 , E out = 10 and mutation probability ρ = 0 .
Revised: The hyperparameters of the outer algorithm were set as follows: N out = 10 , E out = 10 and mutation probability ρ = 0 .

Original: The hyperparameters of the inner algorithm were set as follows: N in = 5 , E in = 3 , initial learning rate = 0.1 and decay rate = 0.75.
Revised: The hyperparameters of the inner algorithm were set as follows: N in = 5 , E in = 3 , initial learning rate = 0.1 and decay rate = 0.75.

Original: These values are the result of a preliminary experimental phase conducted to ﬁnd a good trade-off between performance and computational time. 
Revised: These values are the result of a preliminary experimental phase conducted to find a good trade-off between performance and computational time. 4. Q UERY E FFICIENCY

Revised: Query efficiency is considered a key characteristic for generating realistic attacks.

Original: They allow a maximum of1610 queries  to the victim model we want to attack.
Revised: As highlighted by Ilyas et al. (2018) a limit on the number of queries can result from a time limit or a budget limit, when querying the system costs. Considering the settings used, our system allows a maximum ofqueries to the victim model for each network used in the multi-network system.

Revised: Direct comparisons with other methods are in general difficult due to the differences of the approaches, especially in the case of L p -bounded modifications.

Revised: We report the results obtained on the ImageNet dataset by very recent systems that can be considered query-efficient methods working in the hard-label black-box settings: Ilyas et al.

Revised: (2018), that is based on an evolutionary strategy, reports that effective attacks can be crafted with 270k queries to obtain the 90% of accuracy; in Li et al.

Revised: (2020) the authors report that their best system can produce attacks with a good quality in the 76% of cases with 10k queries or in the 98% of cases with 20k queries.

Revised: In Cheng et al.

Revised: (2020) the authors report that they can reach the 50% of accuracy with 30k queries, but they need 160k queries to reach the 90%.

Revised: It is clear that, comparing these results with our maximum (that varies from 1610 for single network training to 8050 for 5-networks training), AGV-multinetwork is more efficient in all the cases.

Original: 4. A TTACKS AND TRANSFERABILITY
Revised: 4. A TTACKS AND TRANSFERABILITY

Original: In this section, we analyze the multi-network scenario.
Revised: In this section, we analyze the multi-network scenario.

Original: According to (Liu et al., 2017), if an adversarial instance remains adversarial for multiple networks then it is more likely to transfer to other unseen networks as well.
Revised: According to (Liu et al., 2017), if an adversarial instance remains adversarial for multiple networks then it is more likely to transfer to other unseen networks as well.

Original: Therefore, we leverage the capabilities of the AGV single-model by (Baia et al., 2021) algorithm to attack multiple neural networks simultaneously in order to improve the adversarial robustness and generate adversarial examples with high transferability rates.
Revised: Therefore, we leverage the capabilities of the AGV single-model by (Baia et al., 2021) algorithm to attack multiple neural networks simultaneously in order to improve the adversarial robustness and generate adversarial examples with high transferability rates.

Original: We examine the three different multi-network conﬁgurations 5-NET, 4-NET and 3-NET described before with ﬁlter sequences of length 3, 4, and 5.
Revised: We examine the three different multi-network configurations 5-NET, 4-NET and 3-NET described before with filter sequences of length 3, 4, and 5.

Original: In this case, we consider a combination of ﬁlters to be adversarial if it is capable of misleading all models included in the multi-network setup with respect to the Top-1 predicted class.
Revised: In this case, we consider a combination of filters to be adversarial if it is capable of misleading all models included in the multi-network setup with respect to the Top-1 predicted class.

Original: This is the strongest requirement because we ask the system to ﬁnd an adversarial ﬁlter composition that is able to fool all the networks in the multi-network conﬁguration.
Revised: This is the strongest requirement because we ask the system to find an adversarial filter composition that is able to fool all the networks in the multi-network configuration.

Original: This is different from attacking an ensemble network: we guarantee that these images (when they are found) surely will fool all the networks used, while this is not guaranteed by the ensemble training.
Revised: This is different from attacking an ensemble network: we guarantee that these images (when they are found) surely will fool all the networks used, while this is not guaranteed by the ensemble training.

Original: For example Xie et al.
Revised: For example Xie et al.

Original: (2019) showed in their experiments for DI 2 -FGSM and
Revised: (2019) showed in their experiments for DI 2 -FGSM and

Original: M-DI 2 -FGSM that the attacks trained with the ensemble reach the 90% ASR just in few cases.
Revised: M-DI 2 -FGSM that the attacks trained with the ensemble reach the 90% ASR just in few cases.

Original: Results are reported in Table 1.
Revised: Results are reported in Table 1, where the Single-network columns can be considered the baseline results obtained by running the algorithm proposed by Baia et al. (2021) on a single image.

Original: As expected, attacking multiple networks is a more difﬁcult task than attacking single models.
Revised: As expected, attacking multiple networks is a more difficult task than attacking single models.

Original: However, since the multi-network adversarial examples are guaranteed to work across all built-in models this reduces the need to run the algorithm for each single network individually.
Revised: However, since the multi-network adversarial examples are guaranteed to work across all built-in models this reduces the need to run the algorithm for each single network individually.

Original: Unsurprisingly, there is a correlation between the number of ﬁlters and the ASR: longer sequences produce more visible and large modiﬁcations that enables to guide an image towards an adversarial sample more easily.
Revised: Unsurprisingly, there is a correlation between the number of filters and the ASR: longer sequences produce more visible and large modifications that enables to guide an image towards an adversarial sample more easily.

Original: We also computed the transferability usingthe three test models, namely InceptionV3, InceptionV4, and the adversarially trained InceptionResnetV2-ens-adv, for both multiple and single model attacks.
Revised: We also computed the transferability using three test models, namely InceptionV3, InceptionV4, and the adversarially trained InceptionResnetV2-ens-adv, for both multiple and single model attacks.

Original: The results are shown in Table 2.
Revised: The results are shown in Table 2.

Original: In this case, we can notice that the multi-network based attacks achieve higher transferability rates compared to the single-model setup.
Revised: In this case, we can notice that the multi-network based attacks achieve higher transferability rates compared to the single-model setup.

Original: Moreover, our attacks can also mislead InceptionResNetV2-ens-adv on more than 60% of the advesarial samples.
Revised: Moreover, our attacks can also mislead InceptionResNetV2-ens-adv on more than 60% of the adversarial samples.

Original: This shows that even ensemble-adversarially trained models are susceptible to unrestricted ﬁlter-based adversarial perturbations.
Revised: This shows that even ensemble-adversarially trained models are susceptible to unrestricted filter-based adversarial perturbations.

Original: This indicates the potential of the proposed method whose goal is to transform image ﬁlters into malicious applications.
Revised: This indicates the potential of the proposed method whose goal is to transform image filters into malicious applications.

Original: It raises new security issues and challenges for real-world system since it is particularly difﬁcult to distinguish between benign and malignant

Original: ﬁlters.
Revised: [Table]

Original: Comparisons with similar attack models.
Revised: Comparisons with similar attack models.

Original: [Table]

Original: [Table] We also compare our algorithm with other existing adversarial attack methods that have similar colorization and ﬁltering characteristics.
Revised: We also compare our algorithm with other existing adversarial attack methods that have similar colorization and filtering characteristics.

Original: SemanticAdv (Hosseini & Poovendran, 2018) randomly changes the hue and saturation values of an image while not affecting the shape of objects.
Revised: SemanticAdv (Hosseini & Poovendran, 2018) randomly changes the hue and saturation values of an image while not affecting the shape of objects.

Original: Colorfool (Shahin Shamsabadi et al., 2020) uses image semantics to modify the colors by employing priors on color perception trying.
Revised: Colorfool (Shahin Shamsabadi et al., 2020) uses image semantics to modify the colors by employing priors on color perception trying.

Original: It tackles the limitations of SemanticAdv which has been found to produce unnatural looking images.
Revised: It tackles the limitations of SemanticAdv which has been found to produce unnatural looking images.

Original: Edgefool (Shamsabadi et al.) and FilterFool (Shahin Shamsabadi et al., 2021) generate adversarial examples by applying generic image-enhancement ﬁlters obtained by means of neural networks.
Revised: Edgefool (Shamsabadi et al.) and FilterFool (Shahin Shamsabadi et al., 2021) generate adversarial examples by applying generic image-enhancement filters obtained by means of neural networks.

Original: For example, FilterFool-GC tries to create a perturbation that imitates the gamma correction ﬁlter.
Revised: For example, FilterFool-GC tries to create a perturbation that imitates the gamma correction filter.

Original: It is important to note that these methods do not work in a pure hard-label black-box setting because they use the logits information that in general are not exposed and visible to the ﬁnal user.
Revised: It is important to note that these methods do not work in a pure hard-label black-box setting because they use the logits information that in general are not exposed and visible to the final user.

Original: ACE (Zhao et al., 2020), ReColorAdv (Laidlaw & Feizi, 2019), and cAdv (Bhattad et al., 2019) methods use gradient information in order to optimize a color transformation.
Revised: ACE (Zhao et al., 2020), ReColorAdv (Laidlaw & Feizi, 2019), and cAdv (Bhattad et al., 2019) methods use gradient information in order to optimize a color transformation.

Original: In particular, we focus on ACE-Ins1 and ACE-Ins2 which employ two Instagram ﬁlters to guide the color optimization towards speciﬁc styles of enhancement, namely Nashville and Toaster.
Revised: In particular, we focus on ACE-Ins1 and ACE-Ins2 which employ two Instagram filters to guide the color optimization towards specific styles of enhancement, namely Nashville and Toaster.

Original: Adversarial samples generated by the above mentioned methods are reported in Appendix A. 
Revised: Adversarial samples generated by the above mentioned methods are reported in Appendix A. [Table] Tested on

Original:  In Table 3 we report the Attack Success Rates obtained by crafting adversarial samples on the reference model (ASR-ref) and the average  Transferability Rate (Avg-TR) with respect to different testing models.
Revised: [Table] [Table] In Table 3 we report the Attack Success Rates obtained by crafting adversarial samples on the reference model (ASR-ref) and the average and minimum Transferability Rate (avg-TR, min-TR) with respect to different testing models.

Original: Given that the above mentioned techniques were tested on different sets of networks, we decided to report the average value of the published results in order to have an overall panorama of their effectiveness.

Original: We chose as reference model  ResNet50 since data related to it was available in almost all cited works, with the exception of ReColorAdv where we report the ﬁgures regarding InceptionV3.
Revised: The reference model is ResNet50 for all the methods, with the exception of ReColorAdv that used InceptionV3.

Original:  The experimental results show that  our algorithm achieves an attack success rate and transferability rate comparable, and in some cases even better, to these techniques but using less information (top1label vs logits). Attacking all 5 reference models at once results in more transferable attacks. The stars indicate the transferability rates of single-model crafted attacks.
Revised: For the minimum values we also report the target network which represents the hardest model to attack. The experiments show that in most cases our algorithm achieves better results than the other techniques while using less information (top1-label vs logits)

Original: [Table]
Revised: [Table]

Original: From an ASR point of view
Revised: From the ASR point of view

Original: [Table]
Revised: [Table]

Original: the AGV-single method performs better than SemanticAdv and
Revised: the AGV-single method performs better than SemanticAdv and

Original: Colorfool but it falls behind on the transfer rate
Revised: Colorfool but it falls behind on the transfer rate

Original: [Table]
Revised: [Table]

Original: while AGV-multi-network outperform almost all other systems on the hold-out models.
Revised: while AGV-multi-network outperform almost all other systems on the hold-out models.

Original: Given the random nature of its approach, the SemanticAdv generates suspicious perturbations that lead to excessively transformed images (people having blue skin or green horses) which can induce misclassiﬁcation in unseen models more easily.
Revised: Given the random nature of its approach, the SemanticAdv generates suspicious perturbations that lead to excessively transformed images (people with blue skin or green horses) which can induce misclassification in unseen models more easily.

Original: Even though Colorfool tries to limit the adversarial perturbations by using image segmentation to modify the colors within speciﬁc ranges, it often produces noticeable, artiﬁcial colorization effects.
Revised: Even though Colorfool tries to limit the adversarial perturbations by using image segmentation to modify the colors within specific ranges, it often produces noticeable, artificial colorization effects.

Original: This is mostly due to the inaccuracy of the image segmentation techniques that poorly identiﬁes the objects resulting in unnatural colorization patterns, such as skies with pink clouds or dogs half white, half blue.
Revised: This is mostly due to the inaccuracy of the image segmentation techniques that poorly identifies the objects resulting in unnatural colorization patterns, such as skies with pink clouds or dogs half white, half blue.

Original: Despite accessing only the ﬁnal class-label decision of a model, AGV reaches a higher transferability rate than many other methods relying on richer information for the attack process, such as FilterFool, ACE, ReColorAdv and cAdv.
Revised: Despite accessing only the final class-label decision of a model, AGV reaches a higher transferability rate than many other methods relying on richer information for the attack process, such as FilterFool, ACE, ReColorAdv and cAdv.

Original: Moreover, we have a great diversity in terms of ﬁlter styles, ranging from more bright and colourful to more soft and subtle transformations which are frequently found on many social media platforms, like Instagram.
Revised: Moreover, we have a great diversity in terms of filter styles, ranging from more bright and colourful to more soft and subtle transformations which are frequently found on many social media platforms, like Instagram.

Original: Examples that sucessfully transfer to the InceptionResNetV2-ens-adv are illustrated in Figure 3 and 4 in Appendix A. 
Revised: Examples that sucessfully transfer to the InceptionResNetV2-ens-adv are illustrated in Figure 2 and 3 in Appendix A. 4. S TEALTHINESS OF A DVERSARIAL E XAMPLES

Revised: We evaluate the stealthiness of the adversarial examples from two perspectives: stealthiness to human perception and stealthiness to defense mechanisms.

Revised: We measured the human perception by means of most common No-Reference image quality assessment metrics (NR-IQA), such as NIMA,

Original: C ONCLUSIONS AND F UTURE W ORKS
Revised: NIQE and BRISQUE (Talebi & Milanfar, 2018; Mittal et al., 2012; 2013). For this analysis, we calculated the average of the normalized differences between the NR scores on the original images and the corresponding modified images. The results show no significant difference between the scores of clean images and adversarial samples obtained by applying the filter sequence found by the algorithm. Considering the average computed over 12 different experiments that produced about 60k adversarial images, we obtained values in [ − 0 .

Revised: 0479 , 0 . 0006] , with an average of − 0 .

Revised: For the stealthiness to defense mechanisms we considered well-known detecting and sanitizing techniques proposed to counter adversarial attacks.

Revised: As detection methods we tested Feature Squeezing (FS) (Xu et al., 2018) and detectors based on autoencoders and model distillation available in the

Revised: Alibi Detector library (Van Looveren et al., 2019).

Revised: Experimental results on CIFAR-10 dataset show that FS is able to detect less than 10% of adversarial examples as malignant.

Revised: The autoencoder and distillation based methods were able to reach only 25% and 11% detection rate, respectively.

Revised: The adversarial threshold was inferred by assuming 5% of the clean images as outliers.

Revised: As sanitizing

Revised: [Figure]

Revised: techniques we tested jpeg compression, Destylization (Wu et al.) and Instragram-Filter-RemovalNetwork (Kinli et al., 2021).

Revised: Preliminary tests indicate that these methods cannot effectively remove the adversarial perturbations produced by combining multiple filters.

Revised: In the case of jpeg compression we obtain, in most cases, an increasing number of attacks.

Revised: 4. D ECEPTION ABILITY

Revised: An effective attack can be evaluated also with respect to its deception ability, that can be measured by the distance between the original and the assigned class after the modification.

Revised: To do this we computed the rank of the class of the transformed image inside the class distribution of the original image (descending order with respect to the prediction probabilities): the further away, the stronger the deception is.

Revised: Similarly, we also examined the rank of the right class in the distribution of the modified images in order to check how far away it was moved.

Revised: Preliminary results showed that more than 38% of the modified images have been classified with a class that in the original distribution was, on average, over the 5th place.

Revised: On the other hand, in more than 28% the right class was placed, on average, over the 5th position in the distribution computed for the filtered images.

Original: In this work we present the algorithm AGV-multi-network for the optimization of Instagram-style image ﬁlters in a multi-network setting able to fool classiﬁcation systems with a low cost in term of queries and a high transferability rate.
Revised: In this work we present the algorithm AGV-multi-network for the optimization of Instagram-style image filters in a multi-network setting able to fool classification systems with a low cost in term of queries and a high transferability rate.

Original: The algorithm was experimentally tested on a subset of the Imagenet validation set.
Revised: The algorithm was experimentally tested on a subset of the ImageNet validation set.

Original: From the testing phase we can conclude that: ( i ) the algorithm shows very good transferability rate also in the case of adversarial trained network and with respect to other method producing images with evident artifacts; ( ii ) the algorithm is able to craft the attacks using a very limited number of queries.[Figure]
Revised: From the testing phase we can conclude that: ( i ) the algorithm shows very good transferability rate also in the case of adversarial trained network and with respect to other method producing images with evident artifacts; ( ii ) the algorithm is able to craft the attacks using a very limited number of queries.

Original: There is a big room for improvements that are under study.
Revised: There is a big room for improvements that are under study.

Original: In particular we aim to exploit the multiobjective ﬁtness function of the original AGV algorithm in order to craft targeted deceptions, move the right classiﬁcation even further away in the modiﬁed class distribution, apply automatic measure for image quality assessment and optimize the attacks also to avoid detection methods
Revised: In particular we aim to exploit the multiobjective fitness function of the original AGV algorithm in order to craft targeted deceptions, move the right classification even further away in the modified class distribution, apply automatic measure for image quality assessment and optimize the attacks also to avoid detection methods.

Original: A A PPENDIX
Revised: A A PPENDIX

Original: We report different adversarial examples generated by state-of-the-art methods and similar systems.
Revised: We report different adversarial examples generated by state-of-the-art methods and similar systems.

Original: [Figure]
Revised: [Figure]

Original: [Figure] [Figure] 
Revised: [Figure] [Figure] [Figure]

Original: [Figure] [Figure]
Revised: [Figure] [Figure]