The algorithm mentioned in the paper doesn't need any information about the internal structure of the image classifier.