Neural Architecture Dilation for Adversarial Robustness (Supplementary Material) Yanxi Li1