Appendix A. Layer decoding tables

Figure 5: Layer notation of whitebox models and sequence in which layers get added to multiintermediate-layer attacks. Here we discuss the DNN layer notation used throughout the work. We use two whitebox models: ResNet50 (RN50) [9] and DenseNet121 (DN121) [10], which have been shown to be good sources for generating transferable adversarial examples. The RN50 notation follows the implementation in https://github.com/pytorch/vision/ RN50 has 4 layer groups, with {3, 4, 6, 3} Bottleneck blocks in each, respectively.