<table><caption>Table 27: Average highest test accuracy and 95% confidence interval of 10-1 ResNet over 10 runs on CIFAR10 with different train sizes and sequential (Seq) TRGL and VanGL, compared to E2E.</caption><thead><tr><th>Train</th><th>Seq VanGL</th><th>Seq TRGL</th><th>E2E</th></tr></thead><tbody><tr><td>50000</td><td>88.14 ± .14</td><td><strong>88.34</strong> ± .22</td><td>91.88 ± .18</td></tr><tr><td>25000</td><td>84.15 ± .17</td><td><strong>84.46</strong> ± .22</td><td>88.75 ± .27</td></tr><tr><td>10000</td><td>76.62 ± .40</td><td><strong>77.47</strong> ± .35</td><td>82.61 ± .35</td></tr><tr><td>5000</td><td>69.60 ± .43</td><td><strong>70.22</strong> ± .50</td><td>73.93 ± .67</td></tr><tr><td>1000</td><td>51.59 ± .91</td><td><strong>52.06</strong> ± .71</td><td>50.63 ± .98</td></tr></tbody></table>

<table><caption>Table 28: Average last block test accuracy and 95% confidence interval of 50-1 ResNet over 10 runs on CIFAR100 with sequential (Seq) and multi-lap sequential (MLS) TRGL and VanGL, compared to E2E.</caption><thead><tr><th>Seq VanGL</th><th>Seq TRGL</th><th>MLS VanGL</th><th>MLS TRGL</th><th>E2E</th></tr></thead><tbody><tr><td>63.40 ± .46</td><td><strong>63.86</strong> ± .56</td><td>62.59 ± .64</td><td><strong>63.24</strong> ± .50</td><td>63.34 ± 2.41</td></tr></tbody></table>

<table><caption>Table 29: Average test accuracy and 95% confidence interval of ResNeXt50 over 10 runs on CIFAR100 with sequential (Seq), multi-lap sequential (MLS) and parallel (Par) TRGL and VanGL. End-to-end training in this setting achieves an accuracy of 72.97 ± 1.18.</caption><thead><tr><th>Seq VanGL</th><th>Seq TRGL</th><th>MLS VanGL</th><th>MLS TRGL</th><th>Par VanGL</th><th>Par TRGL</th></tr></thead><tbody><tr><td>52.29 ± .53</td><td><strong>52.42</strong> ± .65</td><td>52.59 ± .63</td><td><strong>52.84</strong> ± .65</td><td>57.86 ± .49</td><td><strong>57.93</strong> ± .51</td></tr></tbody></table>

<figure><img src="image_60.png" /><figcaption>Figure 42: Test accuracy after each block of 10-1 ResNet averaged over 10 runs with 95% confidence intervals. Left: multi-lap sequential vanilla (VanGL, in blue) and regularized (TRGL, in red) block-wise training on 10% of the CIFAR100 training set. Right: parallel vanilla (VanGL, in blue) and regularized (TRGL, in red) block-wise training on 10% of CIFAR100 training set.</figcaption></figure>
## G.3 Memory Usage

In Table 30 below, we look at the accuracy of a ResNet110 split into *K* modules that are equally heavy instead of equally deep, which consumes even less memory (see Table 9 in Section 4.5.3). The module-wise training methods are then called VanGL*, TRGL* and InfoPro* as in [Wang et al., 2021]. We notice a slight degradation in the performance of module-wise training compared to Table 6, but the benefit of the regularization increases, as we now gain almost two percentage points of accuracy when using 4 modules, and still outperform end-to-end training.

<table><caption>Table 30: Test accuracy of parallel (Par) TRGL* with *K* modules (average and 95% confidence interval over 5 runs) on STL10, compared to InfoPro* and E2E training from Table 3 in [Wang et al., 2021]</caption><thead><tr><th>Architecture</th><th><i>K</i></th><th>Par VanGL*</th><th>Par TRGL* (ours)</th><th>InfoPro*</th><th>E2E</th></tr></thead><tbody><tr><td rowspan="2">ResNet-110</td><td>2</td><td>79.05 ± 1.33</td><td><b>79.47</b> ± 1.36</td><td>79.05 ± 0.57</td><td>77.73 ± 1.61</td></tr><tr><td>4</td><td>77.14 ± 1.23</td><td><b>78.94</b> ± 1.13</td><td>78.78 ± 0.72</td><td>77.73 ± 1.61</td></tr></tbody></table>

In Table 31 below, we report the memory saved (as a percentage of the memory required for end-to-end training) for the four networks trained module-wise in parallel on TinyImageNet with 4 modules in Table 4, and the Swin-Tiny Transformer [Liu et al., 2021] trained on CIFAR10 with a batch size of 1024, also split into 4 modules trained in parallel, where the regularization increases the test accuracy from 90.96 to 93.2% (average of 5 runs).

<table><caption>Table 31: Memory savings on TinyImageNet (4 first rows) and CIFAR10 (last row) of networks split into 4 modules trained in parallel with a batch size of 256 (4 first rows) and 1024 (last row), as a percentage of the weight of end-to-end training.</caption><thead><tr><th>Architecture</th><th>Par VanGL</th><th>Par TRGL</th></tr></thead><tbody><tr><td>VGG-19</td><td>27%</td><td>21%</td></tr><tr><td>ResNet-50</td><td>26%</td><td>20%</td></tr><tr><td>ResNet-101</td><td>24%</td><td>11%</td></tr><tr><td>ResNet-152</td><td>21%</td><td>8%</td></tr><tr><td>Swin-Tiny</td><td>32%</td><td>30%</td></tr></tbody></table>

Note that methods DDG [Huo et al., 2018b] and FR [Huo et al., 2018a], being delayed gradient methods and not module-wise training methods, do not save memory (they actually increase memory usage, see FR [Huo et al., 2018a]). Sedona [Pyeon et al., 2021] also does not claim to save memory, as their first module (the heaviest) is deeper than the others, but rather to speed up computation. Finally, DGL [Belilovsky et al., 2020] is architecture-wise essentially identical to VanGL and consumes the same amount of memory.
## G.4 Sensitivity to Hyperparameter $\tau$

We show in Figure 43 below that TRGL still performs better than VanGL (in the same setting as in Table 6 in Section 4.5.1, i.e. using a ResNet110 trained on STL10 with 16 modules trained in parallel) for values of $\tau$ from 0.03 to 100 and is still roughly equivalent to it for values up to 5000.

<figure><img src="image_61.png" /><figcaption>Figure 43: Average test accuracy over 5 runs of parallel TRGL using a ResNet110 on STL10 with 16 modules with different values of $\tau$ (in red), and of VanGL (blue line).</figcaption></figure>
<figure><img src="image_62.png" /></figure>
# H Additional Experiments from Section 5

In the tables below, VAN corresponds to detectors trained on a vanilla network, RCE to detectors trained on a network trained with reverse cross entropy and LAP to detectors trained on a transport-regularized network. ‘MH’ refers to the Mahalanobis detector and ‘TR’ refers to our detector.

## H.1 Implementation Details

For ResNeXt50 ([Xie et al., 2017]) on CIFAR100 ([Krizhevsky, 2009]), we train for 300 epochs using SGD with a learning rate of 0.1 (divided by ten at epochs 150, 225 and 250), Kaiming initialization, a batch size of 128 and weight decay of 0.0001. For RCE training, the only changes are that the learning rate is 0.05 and the initialization is orthogonal with a gain of 0.05.

For ResNet110 ([He et al., 2016b]) on CIFAR10 ([Krizhevsky, 2009]), we train for 300 epochs using SGD with a learning rate of 0.1 (divided by ten at epochs 150, 225 and 250), orthogonal initialization with a gain of 0.05, a batch size of 256, weight decay of 0.0001 and gradient clipping at 5. For RCE training, the only change is that we don’t use gradient clipping.

For WideResNet ([Zagoruyko and Komodakis, 2016]) on TinyImageNet, we train for 300 epochs using SGD with a learning rate of 0.1 (divided by ten at epochs 150, 225 and 250), orthogonal initialization with a gain of 0.1, a batch size of 114 and weight decay of 0.0001.

For the magnitude parameter of the Mahalanobis detector, we try all the values tried in their paper for the magnitude and we report the best results.

## H.2 Detection of Seen Attacks

<table><caption>Table 32: Average adversarial detection accuracy of seen attacks and standard deviation over 5 runs using ResNet110 on CIFAR10.</caption><thead><tr><th rowspan="2">Detector</th><th colspan="8">Attack</th></tr><tr><th>FGM</th><th>APGD</th><th>BIM</th><th>DF</th><th>CW</th><th>AA</th><th>HSJ</th><th>BA</th></tr></thead><tbody><tr><td>VAN TR</td><td>97.14 ± 0.59</td><td>94.10 ± 0.41</td><td>97.54 ± 0.52</td><td><strong>99.98</strong> ± 0.49</td><td><strong>98.04</strong> ± 0.47</td><td>88.88 ± 1.34</td><td><strong>99.94</strong> ± 0.11</td><td>96.56 ± 0.56</td></tr><tr><td>RCE TR</td><td>95.96 ± 0.54</td><td>95.32 ± 0.80</td><td>96.16 ± 0.61</td><td>99.92 ± 0.10</td><td>89.36 ± 0.53</td><td></td><td></td><td></td></tr><tr><td>LAP TR</td><td><strong>98.70</strong> ± 0.28</td><td><strong>97.50</strong> ± 0.37</td><td><strong>99.28</strong> ± 0.30</td><td>99.84 ± 0.11</td><td>97.96 ± 0.37</td><td><strong>94.08</strong> ± 0.80</td><td>99.92 ± 0.14</td><td><strong>97.02</strong> ± 0.18</td></tr><tr><td>VAN MH</td><td>87.78 ± 4.20</td><td>82.08 ± 4.00</td><td>86.78 ± 4.70</td><td>91.50 ± 3.17</td><td>85.58 ± 2.60</td><td>80.46 ± 2.24</td><td>85.50 ± 1.75</td><td>80.20 ± 2.11</td></tr><tr><td>RCE MH</td><td>93.00 ± 0.60</td><td>87.88 ± 0.49</td><td>92.30 ± 1.03</td><td>94.98 ± 0.40</td><td>83.38 ± 0.49</td><td></td><td></td><td></td></tr><tr><td>LAP MH</td><td>95.64 ± 0.62</td><td>90.70 ± 0.72</td><td>95.38 ± 0.54</td><td>96.70 ± 0.69</td><td>93.36 ± 0.61</td><td>89.96 ± 0.88</td><td>94.56 ± 0.36</td><td>89.62 ± 0.43</td></tr><tr><td>VAN NS</td><td>94.56 ± 0.67</td><td>94.28 ± 0.54</td><td>95.04 ± 0.52</td><td>99.78 ± 0.10</td><td>93.86 ± 9.22</td><td>88.78 ± 1.41</td><td>99.68 ± 0.10</td><td>92.10 ± 0.46</td></tr></tbody></table>
<table><caption>Table 33: Average adversarial detection accuracy of seen attacks and standard deviation over 5 runs using ResNeXt50 on CIFAR100.</caption><thead><tr><th rowspan="2">Detector</th><th colspan="6">Attack</th></tr><tr><th>FGM</th><th>PGD</th><th>BIM</th><th>AA</th><th>DF</th><th>CW</th></tr></thead><tbody><tr><td>VAN TR</td><td>97.26 ± 0.53</td><td>96.04 ± 0.48</td><td>98.02 ± 0.28</td><td>84.90 ± 0.74</td><td><strong>99.80</strong> ± 0.15</td><td><strong>97.04</strong> ± 0.88</td></tr><tr><td>RCE TR</td><td>97.44 ± 0.43</td><td>96.58 ± 0.14</td><td>97.78 ± 0.22</td><td>50.10 ± 0.09</td><td>99.04 ± 0.14</td><td>92.52 ± 0.34</td></tr><tr><td>LAP TR</td><td><strong>98.32</strong> ± 0.28</td><td><strong>97.84</strong> ± 0.54</td><td><strong>98.92</strong> ± 0.14</td><td><strong>87.56</strong> ± 0.64</td><td>99.58 ± 0.18</td><td>97.80 ± 0.18</td></tr><tr><td>VAN MH</td><td>95.82 ± 0.49</td><td>93.94 ± 0.48</td><td>96.06 ± 0.64</td><td>83.90 ± 0.69</td><td>97.30 ± 0.45</td><td>95.38 ± 0.56</td></tr><tr><td>RCE MH</td><td>96.46 ± 0.43</td><td>94.74 ± 0.44</td><td>96.58 ± 0.60</td><td>50.10 ± 0.09</td><td>97.64 ± 0.44</td><td>88.36 ± 0.62</td></tr><tr><td>LAP MH</td><td>96.82 ± 0.36</td><td>94.60 ± 0.70</td><td>97.76 ± 0.50</td><td>86.58 ± 0.54</td><td>97.12 ± 0.28</td><td>96.42 ± 0.42</td></tr><tr><td>VAN NS</td><td>94.70 ± 0.67</td><td>94.18 ± 0.97</td><td>94.72 ± 0.65</td><td>84.82 ± 0.76</td><td>99.56 ± 0.21</td><td>90.72 ± 1.39</td></tr></tbody></table>

<table><caption>Table 34: Average adversarial detection accuracy of seen attacks and standard deviation over 5 runs using WideResNet on TinyImageNet.</caption><thead><tr><th rowspan="2">Detector</th><th colspan="4">Attack</th></tr><tr><th>FGM</th><th>APGD</th><th>BIM</th><th>AA</th></tr></thead><tbody><tr><td>VAN TR</td><td><strong>95.36</strong> ± 0.36</td><td><strong>95.22</strong> ± 0.50</td><td><strong>95.26</strong> ± 0.46</td><td><strong>81.38</strong> ± 0.38</td></tr><tr><td>LAP TR</td><td>95.14 ± 0.49</td><td>95.20 ± 0.71</td><td>95.12 ± 0.67</td><td>81.24 ± 0.53</td></tr><tr><td>VAN MH</td><td>81.06 ± 1.10</td><td>79.66 ± 1.00</td><td>81.20 ± 1.31</td><td>78.40 ± 0.72</td></tr><tr><td>LAP MH</td><td>85.26 ± 0.96</td><td>85.10 ± 0.60</td><td>82.46 ± 1.62</td><td>78.40 ± 1.04</td></tr><tr><td>VAN NS</td><td>94.90 ± 0.70</td><td>94.86 ± 0.93</td><td>95.00 ± 0.56</td><td>81.32 ± 0.22</td></tr></tbody></table>

## H.3 Detection of Unseen Attacks

<table><caption>Table 35: Average adversarial detection accuracy of unseen attacks after training on FGM and standard deviation over 5 runs using ResNet110 on CIFAR10.</caption><thead><tr><th rowspan="2">Detector</th><th colspan="8">Attack</th></tr><tr><th>APGD</th><th>BIM</th><th>AA</th><th>DF</th><th>CW</th><th>HSJ</th><th>BA</th></tr></thead><tbody><tr><td>VAN TR</td><td>89.3 ± 1.6</td><td>96.0 ± 0.7</td><td><strong>85.1</strong> ± 1.1</td><td><strong>91.0</strong> ± 0.9</td><td><strong>93.2</strong> ± 1.0</td><td><strong>93.0</strong> ± 0.9</td><td><strong>90.9</strong> ± 0.6</td></tr><tr><td>RCE TR</td><td>91.8 ± 1.1</td><td>93.6 ± 1.1</td><td>50.0 ± 0.1</td><td>63.4 ± 1.1</td><td>60.5 ± 0.9</td><td>63.9 ± 1.0</td><td>52.5 ± 0.5</td></tr><tr><td>LAP TR</td><td><strong>92.8</strong> ± 0.5</td><td><strong>98.8</strong> ± 0.4</td><td>84.2 ± 0.5</td><td>75.5 ± 1.2</td><td>75.2 ± 1.0</td><td>76.8 ± 0.6</td><td>75.0 ± 0.4</td></tr><tr><td>VAN MH</td><td>77.3 ± 4.7</td><td>77.2 ± 4.8</td><td>72.1 ± 3.1</td><td>80.1 ± 3.4</td><td>79.9 ± 3.7</td><td>79.7 ± 3.0</td><td>79.3 ± 3.0</td></tr><tr><td>RCE MH</td><td>81.5 ± 0.6</td><td>82.6 ± 1.3</td><td>50.0 ± 0.1</td><td>81.2 ± 0.7</td><td>76.0 ± 0.9</td><td>81.6 ± 0.9</td><td>68.5 ± 1.2</td></tr><tr><td>LAP MH</td><td>87.9 ± 0.8</td><td>84.9 ± 0.4</td><td>81.9 ± 1.2</td><td>81.6 ± 0.7</td><td>81.5 ± 0.6</td><td>81.5 ± 0.3</td><td>81.4 ± 0.8</td></tr><tr><td>VAN NS</td><td>92.1 ± 0.5</td><td>93.9 ± 0.4</td><td>51.8 ± 0.6</td><td>51.4 ± 0.58</td><td>50.84 ± 1.1</td><td>52.1 ± 0.7</td><td>59.9 ± 5.4</td></tr></tbody></table>
<table><caption>Table 36: Average adversarial detection accuracy of unseen attacks after training on FGM and standard deviation over 5 runs using ResNeXt50 on CIFAR100.</caption><thead><tr><th rowspan="2">Detector</th><th colspan="7">Attack</th></tr><tr><th>APGD</th><th>BIM</th><th>AA</th><th>DF</th><th>CW</th><th>HSJ</th><th>BA</th></tr></thead><tbody><tr><td>VAN T</td><td>91.9 ± 0.8</td><td>95.0 ± 0.5</td><td>73.3 ± 1.0</td><td><strong>85.2</strong> ± 0.6</td><td><strong>78.2</strong> ± 1.0</td><td><strong>85.0</strong> ± 0.4</td><td><strong>92.1</strong> ± 4.8</td></tr><tr><td>RCE T</td><td>87.7 ± 0.5</td><td>95.1 ± 0.9</td><td>50.0 ± 0.1</td><td>72.3 ± 0.4</td><td>61.9 ± 0.5</td><td>72.4 ± 0.4</td><td>57.7 ± 0.4</td></tr><tr><td>LAP T</td><td>89.3 ± 0.8</td><td><strong>97.7</strong> ± 0.3</td><td>74.0 ± 1.3</td><td>76.0 ± 1.0</td><td>74.7 ± 1.1</td><td>78.1 ± 3.4</td><td>71.9 ± 3.9</td></tr><tr><td>VAN M</td><td>90.9 ± 0.8</td><td>93.2 ± 0.3</td><td>73.1 ± 0.6</td><td>82.7 ± 0.9</td><td>76.4 ± 0.7</td><td>82.8 ± 1.2</td><td>84.5 ± 2.0</td></tr><tr><td>RCE M</td><td>82.0 ± 0.7</td><td>88.6 ± 0.8</td><td>50.0 ± 0.1</td><td>74.1 ± 0.8</td><td>63.0 ± 0.6</td><td>74.6 ± 0.3</td><td>63.2 ± 0.9</td></tr><tr><td>LAP M</td><td>86.7 ± 0.9</td><td>93.9 ± 0.4</td><td><strong>80.0</strong> ± 0.6</td><td>79.4 ± 1.6</td><td>80.9 ± 2.0</td><td>80.5 ± 3.7</td><td>78.2 ± 2.0</td></tr><tr><td>VAN NS</td><td><strong>92.16</strong> ± 0.41</td><td>93.88 ± 0.97</td><td>51.32 ± 0.41</td><td>51.62 ± 0.53</td><td>51.02 ± 0.43</td><td>52.04 ± 0.74</td><td>57.9 ± 7.52</td></tr></tbody></table>

<table><caption>Table 37: Average adversarial detection accuracy of unseen attacks after training on FGM and standard deviation over 5 runs using WideResNet on TinyImageNet.</caption><thead><tr><th rowspan="2">Detector</th><th colspan="6">Attack</th></tr><tr><th>APGD</th><th>BIM</th><th>AA</th><th>DF</th><th>CW</th><th>HSJ</th></tr></thead><tbody><tr><td>VAN TR</td><td>93.26 ± 0.60</td><td>94.66 ± 0.49</td><td><strong>77.04</strong> ± 0.74</td><td><strong>90.62</strong> ± 0.60</td><td>91.42 ± 1.06</td><td></td></tr><tr><td>LAP TR</td><td>93.48 ± 0.72</td><td><strong>94.80</strong> ± 0.56</td><td>76.58 ± 0.48</td><td>90.12 ± 0.55</td><td><strong>91.52</strong> ± 0.89</td><td></td></tr><tr><td>VAN MH</td><td>76.96 ± 0.94</td><td>77.02 ± 1.08</td><td>60.36 ± 0.62</td><td>73.18 ± 0.59</td><td>75.52 ± 0.82</td><td></td></tr><tr><td>LAP MH</td><td>77.96 ± 0.49</td><td>78.00 ± 0.77</td><td>61.96 ± 0.89</td><td>73.98 ± 1.12</td><td>76.22 ± 0.83</td><td></td></tr><tr><td>VAN NS</td><td><strong>94.06</strong> ± 0.61</td><td>94.62 ± 0.64</td><td>72.82 ± 1.98</td><td>71.96 ± 4.03</td><td>65.60 ± 2.20</td><td></td></tr></tbody></table>

## H.4 Detection Rate of Successful Adversarial Samples

As in [Lee et al., 2018], we might be only concerned with detecting adversarial samples that successfully fool the network and that are created from clean samples that are correctly classified. We find that the detection rate of successful adversarial samples is always very high and close to 100% on our detector. The results are in Table 38 for seen attacks and in Table 39 for unseen attacks.

<table><caption>Table 38: Average detection rate of successful adversarial samples from seen attacks over 5 runs on Network/LAP-Network.</caption><thead><tr><th rowspan="2">Network/Data</th><th rowspan="2">Det</th><th colspan="7">Attack</th></tr><tr><th>FGM</th><th>APGD</th><th>BIM</th><th>AA</th><th>DF</th><th>CW</th><th>HSJ</th></tr></thead><tbody><tr><td rowspan="3">ResNet110<br>CIFAR10</td><td>TR</td><td>97.7/98.6</td><td>99.3/99.4</td><td>98.3/99.6</td><td>100/100</td><td>100/99.9</td><td>98.6/98.7</td><td>100/99.9</td></tr><tr><td>MH</td><td>88.3/93.9</td><td>85.9/86.8</td><td>88.1/93.8</td><td>88.3/95.4</td><td>93.8/98.2</td><td>83.5/93.9</td><td>82.3/95.1</td></tr><tr><td>NS</td><td>95.9</td><td>95.9</td><td>96.4</td><td>99.9</td><td>99.9</td><td><strong>99.9</strong></td><td>99.7</td></tr><tr><td rowspan="3">ResNeXt50<br>CIFAR100</td><td>TR</td><td>98.2/98.6</td><td>97.1/97.9</td><td>98.6/99.2</td><td>100/100</td><td><strong>99.9</strong>/99.4</td><td>99.9/99.6</td><td></td></tr><tr><td>MH</td><td>96.7/97.1</td><td>95.8/92.7</td><td>96.6/98.0</td><td>98.8/98.7</td><td>97.6/97.8</td><td>98.1/98.1</td><td></td></tr><tr><td>NS</td><td>95.0</td><td>94.8</td><td>94.6</td><td>99.9</td><td>99.3</td><td><strong>100</strong></td><td></td></tr><tr><td rowspan="3">WideResNet<br>TinyImageNet</td><td>TR</td><td>95.4/95.9</td><td><strong>96.7</strong>/96.4</td><td>95.0/96.1</td><td>100/100</td><td></td><td></td><td></td></tr><tr><td>MH</td><td>84.0/85.0</td><td>82.7/84.8</td><td>85.8/86.2</td><td>95.6/96.5</td><td></td><td></td><td></td></tr><tr><td>NS</td><td>94.4</td><td>94.5</td><td>94.3</td><td>99.9</td><td></td><td></td><td></td></tr></tbody></table>
<table><caption>Table 39: Average detection rate of successful adversarial samples from unseen attacks after training on FGM over 5 runs.</caption><thead><tr><th rowspan="2">Network/Data</th><th rowspan="2">Detector</th><th colspan="7">Attack</th></tr><tr><th>APGD</th><th>BIM</th><th>AA</th><th>DF</th><th>CW</th><th>HSJ</th><th>BA</th></tr></thead><tbody><tr><td rowspan="3">ResNet110<br>CIFAR10</td><td>TR</td><td><strong>96.94</strong></td><td><strong>98.68</strong></td><td><strong>98.54</strong></td><td><strong>93.42</strong></td><td><strong>92.22</strong></td><td><strong>93.22</strong></td><td><strong>93.38</strong></td></tr><tr><td>MH</td><td>79.80</td><td>78.66</td><td>81.10</td><td>79.96</td><td>78.96</td><td>78.14</td><td>79.42</td></tr><tr><td>NS</td><td>93.02</td><td>94.24</td><td>10.22</td><td>8.12</td><td>8.76</td><td>9.60</td><td>25.50</td></tr><tr><td rowspan="3">ResNeXt50<br>CIFAR100</td><td>TR</td><td><strong>98.76</strong></td><td><strong>98.56</strong></td><td><strong>74.06</strong></td><td><strong>75.14</strong></td><td><strong>72.90</strong></td><td><strong>75.42</strong></td><td><strong>91.04</strong></td></tr><tr><td>MH</td><td>90.86</td><td>93.38</td><td>73.74</td><td>73.64</td><td>72.34</td><td>73.66</td><td>76.44</td></tr><tr><td>NS</td><td>91.8</td><td>93.8</td><td>8.32</td><td>8.06</td><td>7.38</td><td>8.94</td><td>21.9</td></tr><tr><td rowspan="3">WideResNet<br>TinyImageNet</td><td>TR</td><td><strong>100.0</strong></td><td><strong>100.0</strong></td><td><strong>91.06</strong></td><td><strong>95.00</strong></td><td><strong>96.00</strong></td><td></td><td></td></tr><tr><td>MH</td><td>79.16</td><td>86.42</td><td>71.70</td><td>68.34</td><td>76.66</td><td></td><td></td></tr><tr><td>NS</td><td>93.20</td><td>93.98</td><td>54.5</td><td>50.80</td><td>51.96</td><td></td><td></td></tr></tbody></table>

## H.5 False Positive Rate

We report here the false positive rate on seen (Table 40) and unseen (Table 41) attacks.

<table><caption>Table 40: Average false positive rate of seen attacks over 5 runs on Network/LAP-Network.</caption><thead><tr><th rowspan="2">Network/Data</th><th rowspan="2">Det</th><th colspan="7">Attack</th></tr><tr><th>FGM</th><th>APGD</th><th>BIM</th><th>AA</th><th>DF</th><th>CW</th><th>HSJ</th></tr></thead><tbody><tr><td rowspan="3">ResNet110<br>CIFAR10</td><td>TR</td><td>3.3/1.5</td><td>6.3/2</td><td>2.7/0.8</td><td>1.9/1.5</td><td>0.1/0.2</td><td>2.6/2.8</td><td>0.1/0.1</td></tr><tr><td>MH</td><td>13.9/3.5</td><td>18.7/4.7</td><td>13.6/3.1</td><td>13.3/6.4</td><td>10.2/4.6</td><td>12.4/7.4</td><td>11.9/5.8</td></tr><tr><td>NS</td><td>5.4</td><td>4.9</td><td>4.8</td><td>2.9</td><td>0.4</td><td><strong>2.3</strong></td><td>0.3</td></tr><tr><td rowspan="3">ResNeXt50<br>CIFAR100</td><td>TR</td><td>3.4/1.9</td><td>4.6/2.3</td><td>2.5/1.9</td><td>4.0/4.1</td><td>0.2/0.3</td><td>0.3/0.4</td><td></td></tr><tr><td>MH</td><td>5.2/3.3</td><td>6.3/3.6</td><td>4.6/3.3</td><td>13.7/10.8</td><td>2.9/2.7</td><td>2.5/2.2</td><td></td></tr><tr><td>NS</td><td>5.0</td><td>5.0</td><td>4.8</td><td>5.1</td><td><strong>0.2</strong></td><td>2.8</td><td></td></tr><tr><td rowspan="3">WideResNet<br>TinyImageNet</td><td>TR</td><td>3.7/5.2</td><td>5.3/4.9</td><td>3.6/4.6</td><td><strong>6.8/7.0</strong></td><td></td><td></td><td></td></tr><tr><td>MH</td><td>18.1/16.3</td><td>17.5/16.9</td><td>18.0/15.9</td><td>14.8/15.3</td><td></td><td></td><td></td></tr><tr><td>NS</td><td>4.5</td><td><strong>4.5</strong></td><td>4.2</td><td>7.4</td><td></td><td></td><td></td></tr></tbody></table>

<table><caption>Table 41: Average false positive rate of unseen attacks after training on FGM over 5 runs.</caption><thead><tr><th rowspan="2">Network/Data</th><th rowspan="2">Detector</th><th colspan="7">Attack</th></tr><tr><th>APGD</th><th>BIM</th><th>AA</th><th>DF</th><th>CW</th><th>HSJ</th><th>BA</th></tr></thead><tbody><tr><td rowspan="2">ResNet110<br>CIFAR10</td><td>TR</td><td><strong>6.70</strong></td><td><strong>6.02</strong></td><td><strong>8.06</strong></td><td><strong>6.34</strong></td><td><strong>5.64</strong></td><td><strong>6.70</strong></td><td><strong>6.70</strong></td></tr><tr><td>MH</td><td>21.36</td><td>21.46</td><td>23.36</td><td>18.48</td><td>18.86</td><td>18.72</td><td>19.10</td></tr><tr><td rowspan="2">ResNeXt50<br>CIFAR100</td><td>TR</td><td>8.96</td><td>7.10</td><td><strong>7.82</strong></td><td><strong>3.74</strong></td><td><strong>3.74</strong></td><td><strong>4.86</strong></td><td><strong>5.74</strong></td></tr><tr><td>MH</td><td><strong>7.28</strong></td><td><strong>7.08</strong></td><td>7.90</td><td>7.78</td><td>7.68</td><td>7.56</td><td>7.90</td></tr><tr><td rowspan="2">WideResNet<br>TinyImageNet</td><td>TR</td><td><strong>9.44</strong></td><td><strong>9.44</strong></td><td><strong>9.48</strong></td><td><strong>9.44</strong></td><td><strong>9.44</strong></td><td></td><td></td></tr><tr><td>MH</td><td>14.48</td><td>14.54</td><td>14.48</td><td>14.54</td><td>14.82</td><td></td><td></td></tr></tbody></table>
## H.6 AUROC

We report in Table 42 the AUROC of seen attacks, and in Table 43 the AUROC of unseen attacks. Note that the AUROC is computed on the class-agnostic random forest detector, not on the ensemble of the class-agnostic and the class-conditional detectors.

The AUROC is the area under the receiver operating characteristic curve (or ROC curve). The ROC curve plots the true positive rate (TPR) against the false positive rate (FPR), at different threshold values from 0 to 1.

For our random forest classifiers, it is the percentage of decision trees in the forest that detect an adversarial sample (or an out-of-distribution sample) that is compared to the threshold. If it is higher than the threshold, then the input is declared adversarial (or out-of-distribution). If it is lower than the threshold, then the input is declared clean.

<table><caption>Table 42: Average AUROC of seen attacks over 5 runs on Network/LAP-Network.</caption><thead><tr><th rowspan="2">Network/Data</th><th rowspan="2">Det</th><th colspan="4">Attack</th></tr><tr><th>AA</th><th>DF</th><th>CW</th><th>HSJ</th></tr></thead><tbody><tr><td>ResNet110</td><td>TR</td><td>94.91/<b>99.95</b></td><td><b>99.94</b>/99.92</td><td>98.77/<b>99.96</b></td><td><b>99.95</b>/99.94</td></tr><tr><td>CIFAR10</td><td>MH</td><td>81.94/94.17</td><td>89.60/94.17</td><td>88.33/94.31</td><td>86.01/93.45</td></tr><tr><td>ResNeXt50</td><td>TR</td><td><b>99.86</b>/99.70</td><td><b>99.84</b>/99.58</td><td><b>99.85</b>/99.61</td><td></td></tr><tr><td>CIFAR100</td><td>MH</td><td>87.13/94.32</td><td>86.88/91.82</td><td>86.33/91.36</td><td></td></tr><tr><td>WideResNet</td><td>TR</td><td>82.58/<b>82.95</b></td><td></td><td></td><td></td></tr><tr><td>TinyImageNet</td><td>MH</td><td>70.85/71.36</td><td></td><td></td><td></td></tr></tbody></table>

<table><caption>Table 43: Average AUROC of unseen attacks over 5 runs on Network/LAP-Network.</caption><thead><tr><th rowspan="2">Network/Data</th><th rowspan="2">Detector</th><th colspan="4">Attack</th></tr><tr><th>AA</th><th>DF</th><th>CW</th><th>HSJ</th></tr></thead><tbody><tr><td>ResNet110</td><td>TR</td><td><b>82.70</b></td><td><b>90.09</b></td><td><b>88.84</b></td><td><b>87.30</b></td></tr><tr><td>CIFAR10</td><td>MH</td><td>56.46</td><td>62.25</td><td>61.59</td><td>55.89</td></tr><tr><td>ResNeXt50</td><td>TR</td><td><b>71.53</b></td><td><b>72.61</b></td><td><b>71.89</b></td><td><b>74.85</b></td></tr><tr><td>CIFAR100</td><td>MH</td><td>56.60</td><td>56.00</td><td>56.06</td><td>57.07</td></tr><tr><td>WideResNet</td><td>TR</td><td><b>70.37</b></td><td><b>81.06</b></td><td><b>80.22</b></td><td></td></tr><tr><td>TinyImageNet</td><td>MH</td><td>51.61</td><td>51.72</td><td>51.57</td><td></td></tr></tbody></table>

## H.7 Detection of Out-of-Distribution Samples

We report below the AUROC (Table 44 for ResNet110 on CIFAR10 and Table 46 for ResNeXt50 on CIFAR100) and the FPR at a fixed TPR of 95% (Tables 45 for ResNet110 on CIFAR10 and 47 for ResNeXt50 on CIFAR100) for the out-of-distribution detection experiments in Section 5.4.4.
<table><caption>Table 44: Average OOD detection AUROC and standard deviation over 5 runs using ResNet110 trained on CIFAR10.</caption><thead><tr><th rowspan="2">Detector</th><th colspan="2">OOD Experiment 1</th><th colspan="2">OOD Experiment 2</th></tr><tr><th>CIFAR100 (seen)</th><th>SVHN (unseen)</th><th>CW-CIFAR10 (seen)</th><th>SVHN (unseen)</th></tr></thead><tbody><tr><td>VAN TR</td><td>99.64 ± 0.13</td><td>98.74 ± 0.47</td><td><strong>99.32</strong> ± 0.14</td><td><strong>96.29</strong> ± 0.71</td></tr><tr><td>RCE TR</td><td>99.61 ± 0.09</td><td>99.01 ± 0.25</td><td>96.53 ± 0.58</td><td>86.34 ± 3.98</td></tr><tr><td>LAP TR</td><td><strong>99.73</strong> ± 0.09</td><td><strong>99.43</strong> ± 0.28</td><td>99.31 ± 0.07</td><td>96.12 ± 0.59</td></tr><tr><td>VAN MH</td><td>92.74 ± 1.50</td><td>97.00 ± 0.80</td><td>88.38 ± 2.94</td><td>88.04 ± 4.03</td></tr><tr><td>RCE MH</td><td>97.97 ± 0.25</td><td>96.26 ± 0.40</td><td>88.28 ± 2.22</td><td>79.53 ± 3.78</td></tr><tr><td>LAP MH</td><td>98.06 ± 0.38</td><td>96.31 ± 0.75</td><td>95.22 ± 0.90</td><td>86.54 ± 3.60</td></tr></tbody></table>

<table><caption>Table 45: Average OOD detection FPR at 95% TPR and standard deviation over 5 runs using ResNet110 trained on CIFAR10.</caption><thead><tr><th rowspan="2">Detector</th><th colspan="2">OOD Experiment 1</th><th colspan="2">OOD Experiment 2</th></tr><tr><th>CIFAR100 (seen)</th><th>SVHN (unseen)</th><th>CW-CIFAR10 (seen)</th><th>SVHN (unseen)</th></tr></thead><tbody><tr><td>VAN TR</td><td>1.16 ± 0.66</td><td>2.68 ± 1.05</td><td>2.71 ± 1.01</td><td>6.68 ± 0.98</td></tr><tr><td>RCE TR</td><td>1.16 ± 0.41</td><td>1.94 ± 0.86</td><td>19.2 ± 2.35</td><td>24.98 ± 5.43</td></tr><tr><td>LAP TR</td><td><strong>1.02</strong> ± 0.44</td><td><strong>1.54</strong> ± 0.56</td><td><strong>2.70</strong> ± 0.64</td><td><strong>5.68</strong> ± 1.12</td></tr><tr><td>VAN MH</td><td>36.42 ± 4.29</td><td>15.66 ± 1.69</td><td>49.46 ± 4.80</td><td>36.78 ± 6.97</td></tr><tr><td>RCE MH</td><td>7.34 ± 0.90</td><td>20.30 ± 4.45</td><td>41.94 ± 6.44</td><td>52.72 ± 7.71</td></tr><tr><td>LAP MH</td><td>6.98 ± 2.35</td><td>17.56 ± 5.76</td><td>23.06 ± 6.29</td><td>58.40 ± 14.42</td></tr></tbody></table>

<table><caption>Table 46: Average OOD detection AUROC and standard deviation over 5 runs using ResNeXt50 trained on CIFAR100.</caption><thead><tr><th rowspan="2">Detector</th><th colspan="2">OOD Experiment 1</th><th colspan="2">OOD Experiment 2</th></tr><tr><th>AA-CIFAR100 (seen)</th><th>SVHN (unseen)</th><th>CW-CIFAR100 (seen)</th><th>SVHN (unseen)</th></tr></thead><tbody><tr><td>VAN TR</td><td>94.96 ± 0.38</td><td>78.77 ± 1.15</td><td>99.00 ± 0.13</td><td>95.17 ± 0.31</td></tr><tr><td>RCE TR</td><td>50.12 ± 0.05</td><td>50.30 ± 8.13</td><td>87.50 ± 1.65</td><td>79.99 ± 3.62</td></tr><tr><td>LAP TR</td><td><strong>96.45</strong> ± 0.08</td><td>76.28 ± 0.73</td><td><strong>99.16</strong> ± 0.28</td><td>94.84 ± 1.63</td></tr><tr><td>VAN MH</td><td>93.32 ± 0.41</td><td>85.02 ± 0.97</td><td>98.24 ± 0.32</td><td>93.07 ± 0.33</td></tr><tr><td>RCE MH</td><td>50.15 ± 0.08</td><td>58.04 ± 3.56</td><td>86.73 ± 2.03</td><td>77.42 ± 3.38</td></tr><tr><td>LAP MH</td><td>94.87 ± 0.24</td><td><strong>92.76</strong> ± 0.39</td><td>97.84 ± 0.20</td><td><strong>95.92</strong> ± 0.64</td></tr></tbody></table>
<table><caption>Table 47: Average OOD detection FPR at 95% TPR and standard deviation over 5 runs using ResNeXt50 trained on CIFAR100.</caption><thead><tr><th rowspan="2">Detector</th><th colspan="2">OOD Experiment 1</th><th colspan="2">OOD Experiment 2</th></tr><tr><th>AA-CIFAR100 (seen)</th><th>SVHN (unseen)</th><th>CW-CIFAR100 (seen)</th><th>SVHN (unseen)</th></tr></thead><tbody><tr><td>VAN TR</td><td>27.68 ± 1.84</td><td>32.66 ± 1.41</td><td>5.42 ± 0.82</td><td><b>8.90</b> ± 1.20</td></tr><tr><td>RCE TR</td><td>96.12 ± 0.96</td><td>94.72 ± 3.10</td><td>44.12 ± 3.31</td><td>45.68 ± 2.01</td></tr><tr><td>LAP TR</td><td><b>21.62</b> ± 0.30</td><td><b>29.47</b> ± 0.59</td><td><b>4.90</b> ± 0.92</td><td>10.52 ± 3.61</td></tr><tr><td>VAN MH</td><td>29.75 ± 1.09</td><td>39.06 ± 0.96</td><td>8.02 ± 0.81</td><td>16.38 ± 0.82</td></tr><tr><td>RCE MH</td><td>95.28 ± 0.27</td><td>91.42 ± 1.26</td><td>45.12 ± 3.76</td><td>48.45 ± 4.55</td></tr><tr><td>LAP MH</td><td>24.74 ± 0.69</td><td>34.54 ± 1.16</td><td>8.10 ± 0.46</td><td>9.80 ± 1.21</td></tr></tbody></table>
<figure><img src="image_63.png" /></figure>