Algorithm 2. ADM-PGD.

Input: Input image x, Target network D, Adversarial Loss Function $L_{adm-adv}$

Output: Adversarial Image xadv

Parameters: Iteration Number iter, Basic Step Size for Iteration eps, Noise initialization coefficient $\epsilon$

1.  Set Gaussian Noise as initial noise

2.   $x_0=cli{p}_{x,\epsilon }\left(x+\epsilon \cdot noise\right)$

3.   $x_{adv}=x_0$

4.  for j in range $\left(\mathrm{i}\mathrm{t}\mathrm{e}\mathrm{r}\right)$:

5.   $x_{j+1}=cli{p}_{x,\epsilon }\left(x_{adv}+eps\cdot {\mathrm{\nabla }}_x{L}_{adm-adv}\left(x_j\right)\right)$

6.   $x_{adv}=x_{j+1}$

7.  End