Random Normalization Aggregation for Adversarial Defense

Specifically, a random path is sampled during each inference procedure so that the network itself can be treated as an ensemble of a wide range of different models.