SupplementaryMaterial: DualManifoldAdversarialRobustness: Defense againstLpandnon-LpAdversarialAttacks AOM-ImageNetDetails

As pre-processing, each image was center-cropped to produce a square image, and convertedto256 256resolution. In Figure 1, we presentxi (Original) andg(wi)(Projected). Figure 1: Visual comparison between original images and projected images. Weuse the SGD optimizer with the cyclic learning rate scheduling strategyin[10](see Figure 2), momentum0.9,andweightdecay5 For the unseen attacks proposed in [11], we consider attack parameters presented in Table 3. We study how different choices affect the robustness of the trained networks against unseen attacks.