As described in the methodology section, the label remapping function f L we use, is a one-to-one mapping between the labels of the original task and the adversarial task.
white-box based reprogramming outperforms the black-box based approach in all of our experiments.