A Appendix

In Section 3.1, we empirically analyze the differences between SINs of patched and benign images. The benign image set consists of 10000 images randomly selected from ImageNet validation set. We analyze the distribution of SINs in terms of both the standard deviation distance and cluster number. Compared to Equation (3), a penalty loss of activation value is considered. The insights of ScaleCert are shown in Figure 5. Figure 5(a) illustrates the superficial neuron It leverages the weight of deep features (activation in the last convolutional layer) to indicate the importance of deep features for specific classes. Therefore, the discrimination of deep features in the benign images and adversarial images is not intuitive as that in superficial features (as shown in Figure 5(a, b, c)).