To bridge the gap, we use the originally inferred caption ) from the benign image as the initial input to RNN.
after minimizing (8) for T iterations, we run inference on I + δ and set the RNN's input S 1 as its current top-1 prediction, and continue this process.