L(x)+v> L(x) =L(x) + max

B.1 Adversarialthreatmodels Now we introduce different threat models in the adversarial setting following the suggestions in Carlini et al.[6]. Specifically, a threat model includes a set of assumptions about the adversary's goals,capabilities,andknowledge. Adversary's goals could be simply fooling the classifiers to misclassify, which is referred to as untargetedmode. DeepFool [27] is also an iterative attack method, which generates an adversarial example on the decision boundary ofaclassifier withtheminimum perturbation. This optimization problem is solvedbyanAdam[19]optimizer. NES [17] and SPSA [32] adopt the update rule in Eq. (2) for adversarial example generation.