A Implementation Details

For our experiments, we test classifiers with robustness parameters ε { 0, 0 .01 This is equivalent to the PyTorch code: transforms.Compose([ transforms.RandomResizedCrop(size=[224, 224], scale=(3/4, 4/3), ratio=(1., 1.)), transforms.RandomHorizontalFlip() ]) 16 For the TI component, we apply a Gaussian filter to the gradient at each step, with the filter size of For the MI component, we use a momentum of 0. 9. We use a number of models for our experiments. For the CLIP model, we use the code and weights associated with [57]. In this section, we present extended data from the ImageNet. Higher is a more successful attack.