Algorithm 1. ADM-I-FGSM.

Input: Input image x, Target network D, ADM Adversarial Loss Function $L_{adm-adv}$

Output: Adversarial Image xadv

Parameters: Iteration Number iter, Basic Step Size for Iteration eps

1.   $x_0=x$

2.  for j in range $\left(iter\right)$:

3.   $x_{j+1}=cli{p}_{x,\epsilon }\left(x_{adv}+eps\cdot {\mathrm{\nabla }}_x{L}_{adm-adv}\left(x_j\right)\right)$

4.   $x_{adv}=x_{j+1}$

5.  End