A Social Impact

For real-world applications, the DNN model as well as the training dataset, are often hidden from users. We conducted all experiments in an Nvidia-V100 GPU. Imagenet is licensed under Custom (noncommercial). For ResNet-50, DenseNet-121, VGG-16, Inception-v3, we adopt the pre-trained models provided by torchvision package. For SI and Admix, we adopt the parameters suggested in Wang et al.