Supplementary Material for Understanding and Improving Ensemble Adversarial Defense