Before revision:  The proposed method is able to achieve a significant gain of robustness over 15\% comparing with the state-of-the-art. We also show that the proposed regularization method complements other defense paradigms, such as adversarial training, to further improve the robustness .
After revision:  Our method is comprehensively evaluated under multiple settings, including classification against corruptions, adversarial attacks and low data regime. Extensive experimental results show that the proposed regularization method complements other defense paradigms, such as adversarial training, to further improve the robustness .