Algorithm 2 Single Target l2 Attack

$$\begin{array}{cc}\hfill & 1\mathbf{input}:\text{image}{x}_0,\text{predictor}F,L_2\text{distance}ϵ,\text{number}\text{of}\text{iterations}N,\text{number}\text{of}\hfill \\ \hfill & \text{iterations}\text{of}\text{binary}\text{search}m\hfill \\ \hfill & 2\mathbf{output}:\text{adversarial}\text{perturbation}\Delta x\hfill \\ \hfill & 3\text{initialize}{x}^{\prime }\leftarrow x,c\leftarrow c_0,i\leftarrow 0\hfill \\ \hfill & 4{\omega }_0\leftarrow {\tanh }^{-1}(2x-1)\hfill \\ \hfill & 5\mathbf{while}i<m\hfill \\ \hfill & 6\text{flag}\leftarrow \text{False}\hfill \\ \hfill & 7\text{optimizer}\leftarrow \text{optimizer}.\text{minimize}(-c\cdot F\left(\frac{1}{2}(\tanh ({\omega }_0+\Delta \omega )+1)\right)+\Vert \tanh ({\omega }_0+\Delta \omega )-\tanh ({\omega }_0){\Vert }_2)\hfill \\ \hfill & 8\mathbf{while}j<N:\hfill \\ \hfill & 9\Delta \omega \leftarrow \text{optimizer}.\text{run}\_\text{one}\_\text{step}\hfill \\ \hfill & 10\Delta x\leftarrow \frac{1}{2}(\tanh ({\omega }_0+\Delta \omega )-\tanh ({\omega }_0))\hfill \\ \hfill & 11\mathbf{if}\Vert \Delta x{\Vert }_2<ϵ:\hfill \\ \hfill & 12\text{flag}\leftarrow \text{True}\hfill \\ \hfill & 13\mathbf{if}F(x+\Delta x)>F(x^{\prime }):\hfill \\ \hfill & 14x^{\prime }\leftarrow x+\Delta x\hfill \\ \hfill & 15j\leftarrow j+1\hfill \\ \hfill & 16\mathbf{if}\text{flag}:\hfill \\ \hfill & 17\text{increase}c\hfill \\ \hfill & 18\mathbf{else}\hfill \\ \hfill & 19\text{decrease}c\hfill \\ \hfill & 20i\leftarrow i+1\hfill \\ \hfill & 21\Delta x\leftarrow x^{\prime }-x_0\hfill \end{array}$$