2bd7f907b7f5b6bbd91822c0c7b835f6-Supplemental.pdf

Let A be an(N n) matrix whose elements are independent standardnormalrandomvariables. Within the same stage, the same type of residual blocks having 2 convolution operations are used. VGG, DN and DARTS using similar stages design as WRN, VGG has 4 stages, DN and DARTS contain 3 stages. Following our discoveredw10-10-4 configuration, we reduce the 512 channels of VGG-11 and DN-121 of its last stage to 205 channels (i.e.,0.4 512). D.1 Black-boxRobustness Weexplore whether the robustness improvements are still valid inablack-box setting.