Algorithm 1 Single Target l∞ Attack

$$\begin{array}{cc}\hfill & 1\mathbf{input}:\text{predictor}F,l_{\infty }\text{distance}ϵ,\text{iteration steps}N,\text{original image}{x}_0\hfill \\ \hfill & 2\mathbf{output}:\text{adversarial}\text{perturbation}\Delta x\hfill \\ \hfill & 3t\leftarrow 0,i\leftarrow 0\hfill \\ \hfill & 4\alpha \leftarrow ϵ∕N\hfill \\ \hfill & 5\mathbf{while}i<N:\hfill \\ \hfill & 6t\leftarrow t+\alpha \cdot \text{sign}(\nabla F(x_0+t))\hfill \\ \hfill & 7t\leftarrow {\text{clip}}_{[0,1]}(x_0+t)\hfill \\ \hfill & 8i\leftarrow i+1\hfill \\ \hfill & 9\Delta x\leftarrow t\hfill \end{array}$$