Random Normalization Aggregation for Adversarial Defense (Supplementary Material)