Table 1 Additional experiments in terms of classification Accuracy

We thank the reviewers for their valuable comments. We will add suggested experiments, references, and fix typos in the updated version. This phenomenon is consistent with Table 2b in the main body, where we show adversarial learning. Take the large-scale ImageNet as an example. A3: Please refer to Table 1a and A2@R#1 for additional results on ImageNet.