Algorithm 2 HAG-NET generate adversarial embedding examples
Input:	Carrier image Ico, target attack label Tco, accompanying switch, secret message Min, pre-trained target classification network C, maximum training number e.
Output:	Encoder parameters $\varnothing$, decoder parameters $\gamma$ and adversarial stego example $I_E$
1:	${\mathrm{\varnothing }}^0$ ← rand, ${\gamma }^0$← rand, ${\theta }^0$←rand//parameter initialization
2:	for  i ←1,…, e do
3:	$M_{in}^i$ ← rand
4:	Generating $I_A$ by Algorithm 1
5:	$I_E^i$  =  $E_{{\theta }^{i-1}}\left(I_{co},M_{in}^i\right)$
6:	$M_{out}^i$  =  $D_{{\varnothing }^{i-1}}\left(I_E^i\right)$
7:	If   switch = True  then
8:	$\tilde{I}\in \left\{I_A,I_E^i\right\}$
9:	Else
10:	$\tilde{I}\in \left\{I_{co},I_E^i\right\}$
11:	end if
12:	$L_A^i$  =  $L_A\left(A_{{\gamma }^{i-1}}\left(\tilde{I}\right)\right)$
13:	$\gamma$ ← ${\gamma }^i$//Update the parameters $\gamma$ to ${\gamma }^i$
14:	$L_E^i$  =  $L_E\left(\tilde{I}\right)$
15:	$L_G^i$  =  $L_G\left(A_{\gamma }\left(I_E^i\right)\right)$
16:	$L_D^i$  =  $L_D\left(M_{in}^i,M_{out}^i\right)$
17:	$L_C^i$  =  $L_C\left(I_E^i,T_{co}\right)$
18:	Backward ${\lambda }_E\times L_E^i+{\lambda }_G\times L_G^i+L_D^i+{\lambda }_C\times L_C^i$
19:	Update encoder’s parameters ${\theta }^i$ and decoder’s parameters ${\mathrm{\varnothing }}^{\mathrm{i}}$
20	end for
21:	$\theta ={\theta }^e, \varnothing ={\varnothing }^e$//Save the optimal parameters of encoder E, decoder D
22:	$I_E$ = $E_{\theta }\left(I_{co},M_{in}\right)$//Output Adversarial Steganographic example