structure your classifier around unlabeled data we're trying to make sure that on these perturbations are unlabeled here the classifier is still not fooled even though you don't have access to a true label so that's why it's referred to as virtual data Co training it's not actually adversarial training but it shares principles with annual training done cleverly with some mathematical tricks and this is basically the pseudocode for the power iteration method which i mentioned because it works because you linearized