Consider classifier $$f(x)$$ and an adversary who wishes to perform an adversarial task: for inputs $$\bar{x}$$ (not necessarily in the same domain as $$x$$) the adversary wishes to compute a function $$g(\bar{x})$$.
The adversary can accomplish this by learning adversarial reprogramming functions $$H_f(.;\theta)$$ and $$H_g(.;\theta)$$ that maps inputs and outputs between the two task. First the adversary converts the inputs $$\bar{x}$$ into $$x$$ using the functions $$H_f(.;\theta)$$ i.e., $$H_f(\bar{x};\theta)$$ is a valid input to the classifier $$f$$. And the uses the function $$H_g(.;\theta)$$ to maps the output of $$f(H_f(\bar{x};\theta))$$ back to the output of $$g(\bar{x})$$. The parameters $$\theta$$ of the adversarial program are then adjusted to achieve $$H_g(f(H_f(\bar{x};\theta))) = g(\bar{x})$$. Here the $$\theta$$ is called the adversarial program.