A Proofs

A.2 Proof of Lemma 2 Lemma 2. By derivations, there is Now we introduce different threat models in the adversarial setting following the suggestions in Carlini et al. Adversary's goals could be simply fooling the classifiers to misclassify, which is referred to as Adversary's capabilities describe the constraints imposed on the attackers. Adversary's knowledge tells what knowledge the adversary is assumed to own. Below we show the details of the attack methods that we test on in our experiments. The descriptions below mainly adopt from Dong et al. [11].