Algorithm A1 Adversarial Data Hiding Algorithm.

Require:  img, network_model, n, maxiter, popsize, img_class, img_confidence, img_rgb Ensure:  $im{g}_{ADH}$  1:Input the secret message  2:Divide the secret message into n*3 pieces  3:Set the img and size of popsize, maxiter, network_model, n  4:Randomly initialize location coordinates of the parent population according to (5)  5:Define population vector $X_s=(x_1,y_1,x_2,y_2,\cdots ,x_n,$ $y_n)$  6:Set upper and lower bounds of variables $x,y$  7:Set rgb values of the all populations are $(255,255,255)$  8:Read img_class, img_confidence, img_rgb  9:for$g=1,\cdots ,maxiter$do   $\backslash \backslash$g is the generation number 10: Add the newly generated scrambled pixels to the image and observe the confidence 11: for $i=1,\cdots ,popsize$ do 12:  The generation of mutant offspring according to (6) 13: end for 14: New populations are selected according to network_models’ confidence and class 15: Update $X_s$ 16: end for 17:Select the optimal solution of this generation as $X_s(g+1)$ 18:Get the value of $x_1,y_1,x_2,y_2,\cdots ,$$x_n,y_n$ based on $X_s(g+1)$ 19: for $i=1,\cdots ,n$ do 20: Read the original rgb of $(x_i,y_i)$ from img_rgb 21: r, g, b = pixel[1], pixel[2], pixel[3] 22: r, g, b = bin(r), bin(g), bin(b)   $\backslash \backslash$Change rgb as 8-bit binary numbers 23: for $j=1,\cdots ,n$ do 24:  r[j] ← r[0:5] + secret message1[j] 25:  g[j] ← g[0:5] + secret message2[j] 26:  b[j] ← b[0:5] + secret message3[j] 27: end for 28: Generate $im{g}_{ADH}$ 29: end for 30: Final: 31: return $im{g}_{ADH}$