Supplementary Material for Adversarial Robustness through Random Sampling under Constraints

Lemma 1. Considering a fixed Only the highest confidence term in the output of the neural network affects the classification result. For the nonlinear part, which is always defined as ReLU, we have, ReLU (a b) null > ReLU ( a) ReLU (b), if a < 0 and b < 0, = ReLU ( a) ReLU (b), if a > 0 or b > 0 . Since each standard Gaussian distribution is i . The results are shown in Table 1. CIFAR-10 is used as the dataset and all the settings are the same as in the main text. For the attack algorithm, multiple iterations in a round of attack are randomly sampled only once.