Before revision:  We also show that the proposed regularization method complements other defense paradigms, such as adversarial training, to further improve the robustness .
After revision:  We also show that the proposed method can achieve significant improvements in terms of both robustness and generalization performances, when compared with the state-of-the-art methods .