50f3f8c42b998a48057e9d33f4144b8b-Supplemental.pdf

We construct robust source networks by performing adversarialtraining[21,45]. Baseline refers to the misclassification rate of unperturbed images. The adversarial perturbations are subject to an` constraint of16/255, and are optimized with the TMDI-FGSMalgorithm.