Before revision:  To utilize the effect of DA further, we propose a simple yet effective auxiliary 'consistency' regularization loss to optimize, which forces predictive distributions after attacking from two different augmentations  to be similar to each other.
After revision:  To utilize the effect of DA further, we propose a simple yet effective auxiliary 'consistency' regularization loss during AT. Specifically, it forces the predictive distributions after attacking from two different augmentations to be similar to each other.