Algorithm 2: Detecting adversarial examples.

Input: $\mathrm{image} x$, detector Output: $\mathrm{output}=1, \mathrm{image} x$ $\mathrm{is} \mathrm{adversarial}; \mathrm{output}=0, \mathrm{image} x$ is benign $1: y=f\left(x\right)$ $2: x^{\prime }=S\left(y\right)$ $3: F_x=E\left(x\right),F_{x^{\prime }}=E\left(x^{\prime }\right)$ $4: F_{in}=concat\left(F_x,F_{x^{\prime }}\right)$ $5: \mathrm{result}=D$ $(F_{in}$) 6:     if result = 1 7:       $\mathrm{image} x$ is adversarial 8:     else 9:       $\mathrm{image} x$ is benign