Supplementary Material: Toward Efficient Robust Training against Union of l Threat Models

For this, we utilize an implementation by Croce and Hein [2021], together with linear scaling (=10) of the gradient in order to balance the relative scale to random noise.