We also apply PGD-1 and PGD-2 w/wo FN to attack a standard WRN-34-10 model, and PGD-1 (s, m): Heuristically, the value range of s is based on the averaged logit norms of standard