Table 1 Comparison in terms of MAP scores of two

Thank all the reviewers for their valuable comments. We have fixed all the mistakes and made responses to all questions. Given your constructive suggestions, we have confidence on improving our work further. Therefore, these two types of adversarial samples are different. Please refer to our response to Reviewer 2. Other cross-modal tasks are out of the scope for this paper but can Hamming distance between the generated hash codes, thus resulting in effective perturbations.