SupplementaryMaterialforAdversarialRobustness with Non-uniformPerturbations

Consider the 2D toy example of binary classification in Figure A.1 which is obtainedbymodifying[1]. Both relationships are intuitive, and both would be broken by applying uniform perturbations. Activation Bounds: The dual objective function provides a bound on any linear functioncTˆzk. Therefore, we can compute the dual objective forc = I and c = I to obtain lower and upper bounds. Byte addition isstopped when theprediction score getslowerthan a threshold value or the file size exceeds 5MB. This attack isapplied to2000 binaries from EMBER malicious test set for constants "169" and "0", and we call these adversarial example sets C1 Pad. and C2 Pad., respectively.