Due to the high price and heavy energy consumption of GPUs, deploying deep models on IoT devices such as microcontrollers makes significant contributions for ecological AI.

B.1 Adversarialthreatmodels Now we introduce different threat models in the adversarial setting following the suggestions in Carlini et al.[6]. Specifically, a threat model includes a set of assumptions about the adversary's goals,capabilities,andknowledge. Adversary's goals could be simply fooling the classifiers to misclassify, which is referred to as untargetedmode. DeepFool [27] is also an iterative attack method, which generates an adversarial example on the decision boundary ofaclassifier withtheminimum perturbation. This optimization problem is solvedbyanAdam[19]optimizer. NES [17] and SPSA [32] adopt the update rule in Eq. (2) for adversarial example generation.

Inthemeanwhile, another research route focuses onboosting theadversarially trained models via imposing more direct supervision toregularize thelearned representations.