SupplementaryMaterial: DualManifoldAdversarialRobustness: Defense againstLpandnon-LpAdversarialAttacks AOM-ImageNetDetails