Algorithm 1 uses PGD attack method to generate AE
Input:	Cover image $I_{CO}$, the parameters $\beta$ of pre-trained target classification network, the maximum iterations T, the perturbation step size $\alpha$, and the maximum perturbation range S
Output:	Adversarial example IA
1:	$I_A^0\leftarrow I_{CO}$//The initial adversarial example is the cover image.
2:	for    $\mathrm{i}=0:\mathrm{T}$ do
3:	$g^i={\nabla }_{I_{CO}}J\left(\beta ,I_A^i,T_{CO}\right)$//Get the gradient at the current iteration exampl.
4:	$d^i=\alpha \times sign\left(g^i\right)$//Get the perturbation magnitude at the current iteration.
5:	if $I_A^i+d^i\in I_{CO}+S$ then
6:	$I_A^{i+1}=I_A^i+d^i$//Update the perturbed image
7:	Else
8:	$I_A^{i+1}=Clip(I_A^i+d^i,I_{CO}+S)$//Confine the perturbations to the range
9:	end if
10:	end for
11:	$I_A=I_A^T$