• We modify the objective function of the main classifier to incorporate a penalty when the adversarial classifier is good at reconstructing z.
the main classifier tries to update its parameters so as to confuse the duplicate attacker.