Algorithm 1.

Generating optimization-based attack.

for i = 1, 2, …, Ntrain do

for k = 1, 2, …, K do

1. Initialize perturbation p0 randomly; set t = 0;

while t ≤ Niter do

2. Update pt following equations (3) and (4);

3. If $\frac{{\Vert p^t-p^{t-1}\Vert }_2}{{\Vert p^{t-1}\Vert }_2}\le ϵ$ or t = Niter, set $p_i^{*}(k)=p^t$, set t = Niter;

Otherwise, set t = t + 1, go to step 2;

end while

end for

end for

Output $\left\{p_i^{*}(k)\mid i=1,2,\dots ,N_{train},k=1,2,\dots ,K\right\}$