SupplementaryMaterials

In Section B, we give the implementation details of our algorithm and experiments. Besides introducing theflow-based model architecture, wepresent adetailed explanation of classifier architectures and defense mechanisms used to evaluate our method. In Section C, we present an extended version of our simulation results. Otherwise, this means that our NF is simply a data-independent affine transformation. The functionss1,2()andt1,2()are called the scaling and translation functions.