Neural Architecture Dilation for Adversarial Robustness (Supplementary Material) Yanxi Li1

For the dilation architecture, we use a DAG with 4 nodes as the supernetwork. There are 8 operation candidates for each edges, including 4 convolutional operations: 3 3 separable convolutions, 5 5 separable convolutions, 3 3 dilated separable convolutions and 5 5 dilated separable convolutions, 2 pooling operations: 3 3 average pooling and 3 3 max pooling, and two special operations: an identity operation representing skip-connection and a zero operation representing two nodes are not connected. During dilating, we stack 3 cells for each of the 3 blocks in the WRN34-10. During retraining, the number is increased to 6. The dilated architectures designed by NADAR are as shown in Figure 1.