Appendix

In this section, we provide proofs for Proposition 2.1.B. Inthe proof, we inherit the notations that weuseforprovingTheorem2.1. The instance normalization that we incorporate into the DGM is not the same as the instance normalization that is typically used in image stylization [35]. CNN-F-5 significantly improves the robustness of CNN. CNN-F achieves higher accuracy on MNIST than CNN for under both standard training and adversarial training.