Supplementary Material for Adversarial Robustness through Random Sampling under Constraints