We put more experiments details in supplementary materials which

We thank the reviewers for their constructive feedback. The algorithm uses an iterative scheme to find it. It can also be understood as a Fréchet Dual of the original problem. Regarding using the first k-layers be used for the inner-loop adversary. We will include an ablation study in the final version.