Since tanh(y i + w i ) ∈ [−1, 1], the transformation will automatically satisfy the box constraint.
the constrained optimization problem in (1) is equivalent to In the following sections, we present our designed loss functions for different attack settings.