SupplementaryMaterial

As shown in Table 1, the stability of adversarial robustness is evaluated under different inference settings. We first show whether the shuffle of test set influences the performance. Adversarial training isone of the most effective approaches for defending adversarial examples and different variants have been proposed, such as PGD-AT [2], ALP [1]and TLA [3]. Toillustrate the effectiveness of adaptiveweight normalization, we evaluate the classification performance ofANN, ANN-WS andANN-AWNonCIFAR-10 andImageNet. This hyper-parameter is determined by several trials.