Original: RANDOM MASK: T OWARDS R OBUST C ONVOLUTIONAL N EURAL N ETWORKS
Revised: RANDOM MASK: T OWARDS R OBUST C ONVOLUTIONAL N EURAL N ETWORKS

Original: Anonymous authors
Revised: Anonymous authors

Original: Paper under double-blind review
Revised: Paper under double-blind review

Original: A BSTRACT
Revised: A BSTRACT

Original: Robustness of neural networks has recently been highlighted by the adversarial examples , i e., inputs added with well-designed perturbations which are imperceptible to humans but can cause the network to give incorrect outputs.
Revised: Robustness of neural networks has recently been highlighted by the adversarial examples , i e., inputs added with well-designed perturbations which are imperceptible to humans but can cause the network to give incorrect outputs.

Original: In this paper, we design a new
Revised: In this paper, we design a new

Original: CNN architecture that by itself has good robustness.
Revised: CNN architecture that by itself has good robustness.

Original: We introduce a simple but powerful technique, Random Mask , to modify existing CNN structures.
Revised: We introduce a simple but powerful technique, Random Mask , to modify existing CNN structures.

Original: We show that CNNs with
Revised: We show that CNNs with

Original: Random Mask achieve state-of-the-art performance against black-box adversarial attacks without applying any adversarial training.
Revised: Random Mask achieve state-of-the-art performance against black-box adversarial attacks without applying any adversarial training.

Original: We next investigate the adversarial examples which “fool” a CNN with Random Mask.
Revised: We next investigate the adversarial examples which “fool” a CNN with Random Mask.

Original: Surprisingly, we ﬁnd that these adversarial examples often “fool” humans as well.
Revised: Surprisingly, we ﬁnd that these adversarial examples often “fool” humans as well.

Original: This raises fundamental questions on how to deﬁne adversarial examples and robustness properly
Revised: This raises fundamental questions on how to deﬁne adversarial examples and robustness properly

Original:  I NTRODUCTION
Revised:  I NTRODUCTION

Original: Deep learning (LeCun et al., 2015), especially deep Convolutional Neural Network (CNN) (LeCun et al., 1998), has led to state-of-the-art results spanning many machine learning ﬁelds, such as image classiﬁcation (He et al., 2016;
Revised: Deep learning (LeCun et al., 2015), especially deep Convolutional Neural Network (CNN) (LeCun et al., 1998), has led to state-of-the-art results spanning many machine learning ﬁelds, such as image classiﬁcation (He et al., 2016;

Original: Hu et al., 2017b; Huang et al., 2017; Simonyan & Zisserman, 2014), object detection (Redmon et al., 2016; Girshick, 2015; Ren et al., 2015), image captioning (Vinyals et al., 2015; Xu et al., 2015) and speech recognition (Bengio et al., 2003; Hinton et al., 2012).
Revised: Hu et al., 2017b; Huang et al., 2017; Simonyan & Zisserman, 2014), object detection (Redmon et al., 2016; Girshick, 2015; Ren et al., 2015), image captioning (Vinyals et al., 2015; Xu et al., 2015) and speech recognition (Bengio et al., 2003; Hinton et al., 2012).

Original: Despite the great success in numerous applications, recent studies have found that deep CNNs are vulnerable to some well-designed input samples named as Adversarial Examples (Szegedy et al., 2013)
Revised: Despite the great success in numerous applications, recent studies have found that deep CNNs are vulnerable to some well-designed input samples named as Adversarial Examples (Szegedy et al., 2013)

Original: (Biggio et al., 2013).
Revised: (Biggio et al., 2013).

Original: Take the task of image classiﬁcation as an example, for almost every commonly used well-performed
Revised: Take the task of image classiﬁcation as an example, for almost every commonly used well-performed

Original: CNN, attackers are able to construct a small perturbation on an input image to cause the model to give an incorrect output label.
Revised: CNN, attackers are able to construct a small perturbation on an input image to cause the model to give an incorrect output label.

Original: Meanwhile, the perturbation is almost imperceptible to humans .
Revised: Meanwhile, the perturbation is almost imperceptible to humans .

Original: Furthermore, these adversarial examples can easily transfer among different kinds of CNN architectures (Papernot et al., 2016b).
Revised: Furthermore, these adversarial examples can easily transfer among different kinds of CNN architectures (Papernot et al., 2016b).

Original: Such adversarial examples raise serious concerns on deep neural network models as robustness is crucial in many applications.
Revised: Such adversarial examples raise serious concerns on deep neural network models as robustness is crucial in many applications.

Original: Just as Goodfellow (2018) suggests, both robustness and traditional supervised learning seem fully aligned.
Revised: Just as Goodfellow (2018) suggests, both robustness and traditional supervised learning seem fully aligned.

Original: Recently, there is a rapidly growing body of work on this topic.
Revised: Recently, there is a rapidly growing body of work on this topic.

Original: One important line of research is adversarial training (Szegedy et al., 2013;
Revised: One important line of research is adversarial training (Szegedy et al., 2013;

Original: Madry et al., 2017; Goodfellow et al., 2015; Huang et al., 2015).
Revised: Madry et al., 2017; Goodfellow et al., 2015; Huang et al., 2015).

Original: Although adversarial training gains some success, a major difﬁculty is that it tends to overﬁt to the method of adversarial example generation used at training time (Buckman et al., 2018).
Revised: Although adversarial training gains some success, a major difﬁculty is that it tends to overﬁt to the method of adversarial example generation used at training time (Buckman et al., 2018).

Original: Xie et al.
Revised: Xie et al.

Original: (2017) and Guo et al.
Revised: (2017) and Guo et al.

Original: (2017) propose defense methods by introducing randomness and applying transformations to the inputs respectively.
Revised: (2017) propose defense methods by introducing randomness and applying transformations to the inputs respectively.

Original: Dhillon et al.
Revised: Dhillon et al.

Original: (2018) introduces random drop during the evaluation of a neural network.
Revised: (2018) introduces random drop during the evaluation of a neural network.

Original: However, Athalye et al.
Revised: However, Athalye et al.

Original: (2018) contends that such transformation and randomness only provide a kind of “obfuscated gradient” and can be attacked by taking expectation over transformation (EOT) to get a meaningful gradient.
Revised: (2018) contends that such transformation and randomness only provide a kind of “obfuscated gradient” and can be attacked by taking expectation over transformation (EOT) to get a meaningful gradient.

Original: Papernot et al.
Revised: Papernot et al.

Original: (2016a) and Katz et al.
Revised: (2016a) and Katz et al.

Original: (2017) consider the non-linear functions in the networks and try to achieve robustness by adjusting them.
Revised: (2017) consider the non-linear functions in the networks and try to achieve robustness by adjusting them.

Original: There are also detection-based defense methods (Metzen et al., 2017; Grosse et al., 2017;
Revised: There are also detection-based defense methods (Metzen et al., 2017; Grosse et al., 2017;

Original: Meng & Chen, 2017), which add a process of detecting whether an input is adversarial.
Revised: Meng & Chen, 2017), which add a process of detecting whether an input is adversarial.

Original: In this paper, different from most of the existing methods, we take another approach to tackle the adversarial example problem.
Revised: In this paper, different from most of the existing methods, we take another approach to tackle the adversarial example problem.

Original: In particular, we aim to design a new CNN architecture which by itself enjoys robustness, without appealing to techniques such as adversarial training.
Revised: In particular, we aim to design a new CNN architecture which by itself enjoys robustness, without appealing to techniques such as adversarial training.

Original: To this end, we introduce Random Mask as a new ingredient of CNN.
Revised: To this end, we introduce Random Mask as a new ingredient of CNN.

Original: To be speciﬁc, we randomly select a set of neurons and remove them from the network before training.
Revised: To be speciﬁc, we randomly select a set of neurons and remove them from the network before training.

Original: Then the architecture of the network is ﬁxed during the training and testing process.
Revised: Then the architecture of the network is ﬁxed during the training and testing process.

Original: Note that Random Mask is different from dropout which randomly masks out neurons in each step during training.
Revised: Note that Random Mask is different from dropout which randomly masks out neurons in each step during training.

Original: In addition, Random Mask can be applied very easily to common CNN structures such as ResNet with only a few changes of code.
Revised: In addition, Random Mask can be applied very easily to common CNN structures such as ResNet with only a few changes of code.

Original: We ﬁnd that applying Random Mask to the shallow layers of the network is crucial for robustness.
Revised: We ﬁnd that applying Random Mask to the shallow layers of the network is crucial for robustness.

Original: CNNs with properly designed Random Mask are far more robust than standard
Revised: CNNs with properly designed Random Mask are far more robust than standard

Original: CNNs.
Revised: CNNs.

Original: In fact, our experimental results demonstrate that CNNs with Random Mask achieve state-of-the-art results against black-box attacks even when comparing with defense methods using adversarial training.
Revised: In fact, our experimental results demonstrate that CNNs with Random Mask achieve state-of-the-art results against black-box attacks even when comparing with defense methods using adversarial training.

Original: Furthermore, CNNs with Random Mask maintain a high accuracy on normal test data, while low test accuracy is often regarded as a major weakness in many methods designed for achieving robustness.
Revised: Furthermore, CNNs with Random Mask maintain a high accuracy on normal test data, while low test accuracy is often regarded as a major weakness in many methods designed for achieving robustness.

Original: We next take a closer look at the adversarial examples generated particularly against CNNs with Random Mask.
Revised: We next take a closer look at the adversarial examples generated particularly against CNNs with Random Mask.

Original: We investigate the adversarial examples that can “fool” our proposed architecture, i.e., the examples that are perturbed version of the original image, but are classiﬁed to a different label by the network.
Revised: We investigate the adversarial examples that can “fool” our proposed architecture, i.e., the examples that are perturbed version of the original image, but are classiﬁed to a different label by the network.

Original: Surprisingly, we ﬁnd that the adversarial examples which can “fool” a CNN with Random Mask often “fool” humans as well.
Revised: Surprisingly, we ﬁnd that the adversarial examples which can “fool” a CNN with Random Mask often “fool” humans as well.

Original: It is difﬁcult for humans to correctly classify these adversarial example, and in many cases humans make the same “incorrect” prediction as our network.
Revised: It is difﬁcult for humans to correctly classify these adversarial example, and in many cases humans make the same “incorrect” prediction as our network.

Original: Figure 1 shows a few adversarial examples generated by PGD (Basic iterative method)
Revised: Figure 1 shows a few adversarial examples generated by PGD (Basic iterative method)

Original: (Kurakin et al., 2016) with respect to a CNN with Random Mask as well as the labels the network outputs.
Revised: (Kurakin et al., 2016) with respect to a CNN with Random Mask as well as the labels the network outputs.

Original: (Please also see Figure 12 in Appendix E.1 for the original images and labels from CIFAR-10.)
Revised: (Please also see Figure 12 in Appendix E.1 for the original images and labels from CIFAR-10.)

Original: They are different from the typical adversarial examples generated against commonly used
Revised: They are different from the typical adversarial examples generated against commonly used

Original: CNNs, which usually look like noisy versions of the original images and are easy to be correctly classiﬁed by humans.
Revised: CNNs, which usually look like noisy versions of the original images and are easy to be correctly classiﬁed by humans.

Original: These observations raise important questions: 1) How should we deﬁne adversarial examples?
Revised: These observations raise important questions: 1) How should we deﬁne adversarial examples?

Original: How should we deﬁne robustness?
Revised: How should we deﬁne robustness?

Original: Currently, an adversarial example is usually deﬁned as a perturbed datum which lies in the neighborhood of the original data but has a different classiﬁcation output by the network; and the robustness of a method is measured according to the proportion of these adversarial examples.
Revised: Currently, an adversarial example is usually deﬁned as a perturbed datum which lies in the neighborhood of the original data but has a different classiﬁcation output by the network; and the robustness of a method is measured according to the proportion of these adversarial examples.

Original: However, if an adversarial example can also fool humans, it is more appropriate to say that the example does change the semantics of the datum to a certain extent.
Revised: However, if an adversarial example can also fool humans, it is more appropriate to say that the example does change the semantics of the datum to a certain extent.

Original: After all, why two images close to each other in terms of some distance (e.g., (cid:96) ∞ ) must belong to the same class?
Revised: After all, why two images close to each other in terms of some distance (e.g., (cid:96) ∞ ) must belong to the same class?

Original: How close should they be so that they belong to the same class?
Revised: How close should they be so that they belong to the same class?

Original: Without complete answers to these questions, one should be very careful when measuring the robustness of a model merely according to currently-deﬁned adversarial examples.
Revised: Without complete answers to these questions, one should be very careful when measuring the robustness of a model merely according to currently-deﬁned adversarial examples.

Original: Robustness is a subtle issue.
Revised: Robustness is a subtle issue.

Original: We argue that one needs to rethink the robustness and adversarial examples from the deﬁnitions.
Revised: We argue that one needs to rethink the robustness and adversarial examples from the deﬁnitions.

Original: [Figure]
Revised: [Figure]

Original: Our main contributions are summarized as follows:
Revised: Our main contributions are summarized as follows:

Original: • We develop a very simple but effective method, Random Mask .
Revised: • We develop a very simple but effective method, Random Mask .

Original: We show that combining with Random Mask, existing CNNs can be signiﬁcantly more robust while maintaining high generalization performance.
Revised: We show that combining with Random Mask, existing CNNs can be signiﬁcantly more robust while maintaining high generalization performance.

Original: In fact, CNNs equipped with Random Mask achieve state-of-the-art performance against several black-box attacks, even when comparing with methods using adversarial training (See Table 1).
Revised: In fact, CNNs equipped with Random Mask achieve state-of-the-art performance against several black-box attacks, even when comparing with methods using adversarial training (See Table 1).

Original: • We investigate the adversarial examples generated against CNNs with Random Mask.
Revised: • We investigate the adversarial examples generated against CNNs with Random Mask.

Original: We ﬁnd that adversarial examples that can “fool” a CNN with Random Mask often fool humans as well.
Revised: We ﬁnd that adversarial examples that can “fool” a CNN with Random Mask often fool humans as well.

Original: This observation requires us to rethink what are the right deﬁnitions of adversarial examples and robustness.
Revised: This observation requires us to rethink what are the right deﬁnitions of adversarial examples and robustness.

Original:  R ANDOM M ASK
Revised:  R ANDOM M ASK

Original: We propose Random Mask, a method to modify existing CNN structures.
Revised: We propose Random Mask, a method to modify existing CNN structures.

Original: It randomly selects a set of neurons and removes them from the network before training.
Revised: It randomly selects a set of neurons and removes them from the network before training.

Original: Then the architecture of the network is ﬁxed during the training and testing process.
Revised: Then the architecture of the network is ﬁxed during the training and testing process.

Original: To apply Random Mask on a selected layer Layer ( j ) , suppose the input is X j and the output is conv
Revised: To apply Random Mask on a selected layer Layer ( j ) , suppose the input is X j and the output is conv

Original: j ( X j ) ∈
Revised: j ( X j ) ∈

Original: R m j × n j × c j .
Revised: R m j × n j × c j .

Original: We randomly generate a binary mask mask ( j ) ∈ { 0 , 1 }
Revised: We randomly generate a binary mask mask ( j ) ∈ { 0 , 1 }

Original: m j × n j × c
Revised: m j × n j × c

Original: j by sampling uniformly within each channel.
Revised: j by sampling uniformly within each channel.

Original: The drop rate of the sampling process is called the ratio (or drop ratio ) of Random Mask.
Revised: The drop rate of the sampling process is called the ratio (or drop ratio ) of Random Mask.

Original: Then we mask the neurons in position ( x, y, c ) of the output of Layer ( j ) if the ( x, y, c ) element of mask ( j ) is zero.
Revised: Then we mask the neurons in position ( x, y, c ) of the output of Layer ( j ) if the ( x, y, c ) element of mask ( j ) is zero.

Original: More speciﬁcally, after Random Mask, we will not compute these masked neurons and make the next layer regard these neurons as having value zero during computation.
Revised: More speciﬁcally, after Random Mask, we will not compute these masked neurons and make the next layer regard these neurons as having value zero during computation.

Original: A simple visualization of Random Mask is shown in Figure 2.
Revised: A simple visualization of Random Mask is shown in Figure 2.

Original: The Random Mask in fact decreases the computational cost in each epoch since there are fewer effective connections.
Revised: The Random Mask in fact decreases the computational cost in each epoch since there are fewer effective connections.

Original: Note that the number of parameters in the convolutional kernels remains unchanged , since we only mask neurons in the feature maps.
Revised: Note that the number of parameters in the convolutional kernels remains unchanged , since we only mask neurons in the feature maps.

Original: In the standard setting, convolutional ﬁlter will be applied uniformly to every position of the feature map of the former layer.
Revised: In the standard setting, convolutional ﬁlter will be applied uniformly to every position of the feature map of the former layer.

Original: The success of this implementation is due to the reasonable assumption that if one feature is useful to be computed at some spatial position ( x, y ) , then it should also be useful to be computed at a different position ( x (cid:48) , y (cid:48) ) .
Revised: The success of this implementation is due to the reasonable assumption that if one feature is useful to be computed at some spatial position ( x, y ) , then it should also be useful to be computed at a different position ( x (cid:48) , y (cid:48) ) .

Original: Thus the original structure is powerful for feature extraction.
Revised: Thus the original structure is powerful for feature extraction.

Original: Moreover, this structure leads to parameter sharing which makes the training process more efﬁcient.
Revised: Moreover, this structure leads to parameter sharing which makes the training process more efﬁcient.

Original: However, the uniform application of ﬁlter also prevents the CNN from noticing the distribution of features.
Revised: However, the uniform application of ﬁlter also prevents the CNN from noticing the distribution of features.

Original: In other words, the network focuses on the existence of a kind of feature but pays little attention to how this kind of feature distributes on the whole feature map (of the former layer).
Revised: In other words, the network focuses on the existence of a kind of feature but pays little attention to how this kind of feature distributes on the whole feature map (of the former layer).

Original: Yet the pattern of feature distribution is important for humans to recognize and classify a photo, since empirically people would rely on some structured feature to perform classiﬁcation.
Revised: Yet the pattern of feature distribution is important for humans to recognize and classify a photo, since empirically people would rely on some structured feature to perform classiﬁcation.

Original: With Random Mask, each ﬁlter may only extract features from partial positions.
Revised: With Random Mask, each ﬁlter may only extract features from partial positions.

Original: More speciﬁcally, for one ﬁlter, only features which distribute consistently with the mask pattern can be extracted.
Revised: More speciﬁcally, for one ﬁlter, only features which distribute consistently with the mask pattern can be extracted.

Original: Hence ﬁlters in a network with Random Mask may capture more information on the spatial structures of local features.
Revised: Hence ﬁlters in a network with Random Mask may capture more information on the spatial structures of local features.

Original: Just think of a toy example: imagine Random Mask for a ﬁlter masks all the neurons but one row in the channel, if a kind of feature usually distributes in a column, it can not have strong response because the ﬁlter can only capture a small portion of the feature.
Revised: Just think of a toy example: imagine Random Mask for a ﬁlter masks all the neurons but one row in the channel, if a kind of feature usually distributes in a column, it can not have strong response because the ﬁlter can only capture a small portion of the feature.

Original: We do a straightforward experiment to verify our intuition.
Revised: We do a straightforward experiment to verify our intuition.

Original: We sample some images from ImageNet which can be correctly classiﬁed with high probability by both CNNs with and without Random Mask.
Revised: We sample some images from ImageNet which can be correctly classiﬁed with high probability by both CNNs with and without Random Mask.

Original: We then randomly shufﬂe the images by patches, and compare the accuracy of classifying the shufﬂed images (See
Revised: We then randomly shufﬂe the images by patches, and compare the accuracy of classifying the shufﬂed images (See

Original: Appendix A).
Revised: Appendix A).

Original: We ﬁnd out that the accuracy of the CNN with Random Mask is consistently lower than that of normal CNN.
Revised: We ﬁnd out that the accuracy of the CNN with Random Mask is consistently lower than that of normal CNN.

Original: This result shows that CNNs without Random Mask cares more about whether a feature exists while CNNs with Random Mask will detect spatial structures and limit poorly-organized features from being extracted .
Revised: This result shows that CNNs without Random Mask cares more about whether a feature exists while CNNs with Random Mask will detect spatial structures and limit poorly-organized features from being extracted .

Original: We further explore how Random Mask plays its role in defending against adversarial examples.
Revised: We further explore how Random Mask plays its role in defending against adversarial examples.

Original: Recent observation (Liu et al., 2018) of adversarial examples found that these examples usually change a patch of the original image so that the perturbed patch looks like a small part of the incorrectly classiﬁed object.
Revised: Recent observation (Liu et al., 2018) of adversarial examples found that these examples usually change a patch of the original image so that the perturbed patch looks like a small part of the incorrectly classiﬁed object.

Original: This perturbed patch, although contains crucial features of the incorrectly classiﬁed object, usually appears at the wrong location and does not have the right spatial structure with other parts of the image.
Revised: This perturbed patch, although contains crucial features of the incorrectly classiﬁed object, usually appears at the wrong location and does not have the right spatial structure with other parts of the image.

Original: For example (See
Revised: For example (See

Original: Figure 11 in Liu et al.
Revised: Figure 11 in Liu et al.

Original: , the adversarial example of a panda image is misclassiﬁed as a monkey because a patch of the panda skin is perturbed adversarially so that it alone looks like the monkey’s face.
Revised: , the adversarial example of a panda image is misclassiﬁed as a monkey because a patch of the panda skin is perturbed adversarially so that it alone looks like the monkey’s face.

Original: However, this patch does not form a right structure of a monkey with other parts of the images.
Revised: However, this patch does not form a right structure of a monkey with other parts of the images.

Original: By the properties of detecting spatial structures and limiting feature extraction, Random Mask can naturally help CNNs resist such adversarial perturbations.
Revised: By the properties of detecting spatial structures and limiting feature extraction, Random Mask can naturally help CNNs resist such adversarial perturbations.

Original: In complement to the observation we mentioned above, we also ﬁnd that most adversarial perturbations generated against normal CNNs look like random noises which do not change the semantic information of the original image.
Revised: In complement to the observation we mentioned above, we also ﬁnd that most adversarial perturbations generated against normal CNNs look like random noises which do not change the semantic information of the original image.

Original: In contrast, adversarial examples generated against CNNs with Random Mask tend to contain some well-organized features which sometimes change the classiﬁcation results semantically (See
Revised: In contrast, adversarial examples generated against CNNs with Random Mask tend to contain some well-organized features which sometimes change the classiﬁcation results semantically (See

Original: Figure 3 and Figure 1).
Revised: Figure 3 and Figure 1).

Original: This phenomenon also supports our intuition that Random Mask helps to detect spatial structures and extract well-organized features via imposing limitations.
Revised: This phenomenon also supports our intuition that Random Mask helps to detect spatial structures and extract well-organized features via imposing limitations.

Original: [Figure]
Revised: [Figure]

Original: While the features that can be learned by each masked ﬁlter is limited, the randomness helps us get plenty of diversiﬁed patterns.
Revised: While the features that can be learned by each masked ﬁlter is limited, the randomness helps us get plenty of diversiﬁed patterns.

Original: Our experiments show that these limited ﬁlters are enough for learning features.
Revised: Our experiments show that these limited ﬁlters are enough for learning features.

Original: In other words, CNNs will maintain a high test accuracy after being applied with Random Mask.
Revised: In other words, CNNs will maintain a high test accuracy after being applied with Random Mask.

Original: Besides, adding convolutional ﬁlters may help our CNN with Random Mask to increase test accuracy (See Section 3.3).
Revised: Besides, adding convolutional ﬁlters may help our CNN with Random Mask to increase test accuracy (See Section 3.3).

Original: Furthermore, our structure is naturally compatible to ensemble methods, and randomness makes ensemble more powerful (See Section 3.3).
Revised: Furthermore, our structure is naturally compatible to ensemble methods, and randomness makes ensemble more powerful (See Section 3.3).

Original: However, it might not be appropriate to apply Random Mask to deep layers.
Revised: However, it might not be appropriate to apply Random Mask to deep layers.

Original: The distribution of features is meaningful only when the location in feature map is highly related to the location in the original input image , and the receptive ﬁeld of each neuron in deep layers is too large.
Revised: The distribution of features is meaningful only when the location in feature map is highly related to the location in the original input image , and the receptive ﬁeld of each neuron in deep layers is too large.

Original: In Section 3.3, there are empirical results which support our intuition.
Revised: In Section 3.3, there are empirical results which support our intuition.

Original:  E XPERIMENTS
Revised:  E XPERIMENTS

Original: In this section, we provide extensive experimental analyses on the performance and properties of Random
Revised: In this section, we provide extensive experimental analyses on the performance and properties of Random

Original: Mask network structure.
Revised: Mask network structure.

Original: We ﬁrst test the robustness of Random Mask (See Section 3.1).
Revised: We ﬁrst test the robustness of Random Mask (See Section 3.1).

Original: Then we take a closer look at the adversarial examples that can “fool” our proposed architecture (See Section 3.2).
Revised: Then we take a closer look at the adversarial examples that can “fool” our proposed architecture (See Section 3.2).

Original: After that we explore properties of Random Mask, including where and how to apply Random Mask, by a series of comparative experiments (See Section 3.3).
Revised: After that we explore properties of Random Mask, including where and how to apply Random Mask, by a series of comparative experiments (See Section 3.3).

Original: Some settings used in our experiments are listed below:
Revised: Some settings used in our experiments are listed below:

Original: Network Structure.
Revised: Network Structure.

Original: We apply Random Mask to several target networks, including ResNet-18 (He et al., 2016), ResNet-50, DenseNet-121 (Huang et al., 2017), SENet-18 (Hu et al., 2017b) and VGG-19 (Simonyan & Zisserman, 2014).
Revised: We apply Random Mask to several target networks, including ResNet-18 (He et al., 2016), ResNet-50, DenseNet-121 (Huang et al., 2017), SENet-18 (Hu et al., 2017b) and VGG-19 (Simonyan & Zisserman, 2014).

Original: The effects of Random Mask on those network structures are quite consistent.
Revised: The effects of Random Mask on those network structures are quite consistent.

Original: For brevity, we only show the defense performance on ResNet-18 in the main body and leave more experimental results in the Appendix F.
Revised: For brevity, we only show the defense performance on ResNet-18 in the main body and leave more experimental results in the Appendix F.

Original: The 5-block structure of ResNet-18 is shown in the Appendix C.1.
Revised: The 5-block structure of ResNet-18 is shown in the Appendix C.1.

Original: The blocks are labeled 0 , 1 , 2 , 3 , 4 and the 0 th block is the ﬁrst convolution layer.
Revised: The blocks are labeled 0 , 1 , 2 , 3 , 4 and the 0 th block is the ﬁrst convolution layer.

Original: We divide these ﬁve blocks into two parts - the relative shallow ones (the 0 th , 1 st , 2 nd blocks) and the deep ones (the 3 rd , 4 th blocks).
Revised: We divide these ﬁve blocks into two parts - the relative shallow ones (the 0 th , 1 st , 2 nd blocks) and the deep ones (the 3 rd , 4 th blocks).

Original: For simplicity, we would like to regard each of these two parts as a whole in this section to avoid being trapped by details.
Revised: For simplicity, we would like to regard each of these two parts as a whole in this section to avoid being trapped by details.

Original: We use “ σ -Shallow” and “ σ -Deep” to denote that we apply Random Mask with drop ratio σ to the shallow blocks and to the deep blocks in ResNet-18 respectively.
Revised: We use “ σ -Shallow” and “ σ -Deep” to denote that we apply Random Mask with drop ratio σ to the shallow blocks and to the deep blocks in ResNet-18 respectively.

Original: Attack Framework.
Revised: Attack Framework.

Original: The accuracy under black-box attack serves as a common criterion of robustness.
Revised: The accuracy under black-box attack serves as a common criterion of robustness.

Original: We will use it when selecting model parameters and comparing Random Mask to other similar structures.
Revised: We will use it when selecting model parameters and comparing Random Mask to other similar structures.

Original: To be more speciﬁc, by using FGSM (Goodfellow et al., 2015), PGD (Kurakin et al., 2016) with (cid:96) ∞ norm and CW attack (Carlini & Wagner, 2016) with (cid:96) 2 norm (See  details of three attack approaches in Appendix B), we generate adversarial examples against different neural networks.
Revised: To be more speciﬁc, by using FGSM (Goodfellow et al., 2015), PGD (Kurakin et al., 2016) with (cid:96) ∞ norm and CW attack (Carlini & Wagner, 2016) with (cid:96) 2 norm (See Appendix B for details on these attack approaches), we generate adversarial examples against different neural networks.

Original: The performances on adversarial examples generated against different networks are quite consistent.
Revised: The performances on adversarial examples generated against different networks are quite consistent.

Original: For brevity, we only show the defense performance against part of the adversarial examples generated by using DenseNet-121 on dataset CIFAR-10 in this section, and leave more experimental results obtained by using other adversarial examples in the Appendix F.
Revised: For brevity, we only show the defense performance against part of the adversarial examples generated by using DenseNet-121 on dataset CIFAR-10 in this section, and leave more experimental results obtained by using other adversarial examples in the Appendix F.

Original: We use FGSM 16 , PGD 16 , PGD 32 , CW 40 to denote attack method FGSM with step size (cid:15) = 16 , PGD with perturbation scale α = 16 and step number 20 , PGD with perturbation scale α = 32 and step number 40 , CW attack with conﬁdence κ = 40 respectively.
Revised: We use FGSM 16 , PGD 16 , PGD 32 , CW 40 to denote attack method FGSM with step size (cid:15) = 16 , PGD with perturbation scale α = 16 and step number 20 , PGD with perturbation scale α = 32 and step number 40 , CW attack with conﬁdence κ = 40 respectively.

Original: The step size of both PGD methods are selected to be (cid:15)
Revised: The step size of both PGD methods are selected to be (cid:15)

Original: = 1 .
Revised: = 1 .

Original: We would like to point out that these attacks are really powerful that a normal network cannot resist these attacks.
Revised: We would like to point out that these attacks are really powerful that a normal network cannot resist these attacks.

Original: 3. R OBUSTNESS VIA R ANDOM M ASK
Revised: 3. R OBUSTNESS VIA R ANDOM M ASK

Original: Random Mask is not specially designed for adversarial defense, but as Random Mask introduces information that is essential for classifying correctly, it also brings robustness.
Revised: Random Mask is not specially designed for adversarial defense, but as Random Mask introduces information that is essential for classifying correctly, it also brings robustness.

Original: As mentioned in Section 2, normal CNN structures may allow adversary to inject features imperceptible to humans into images that can be recognized by CNN.
Revised: As mentioned in Section 2, normal CNN structures may allow adversary to inject features imperceptible to humans into images that can be recognized by CNN.

Original: Yet Random Mask limits the process of feature extraction, so noisy features are less likely to be preserved.
Revised: Yet Random Mask limits the process of feature extraction, so noisy features are less likely to be preserved.

Original: 3.1. R OBUSTNESS TO B LACK - BOX A TTACK
Revised: 3.1. R OBUSTNESS TO B LACK - BOX A TTACK

Original: The results of our experiments show the strengths of applying Random Mask to adversarial defense.
Revised: The results of our experiments show the strengths of applying Random Mask to adversarial defense.

Original: In fact,
Revised: In fact,

Original: Random Mask can help existing CNNs reach state-of-the-art performance against the black-box attacks we use (See Table 1).
Revised: Random Mask can help existing CNNs reach state-of-the-art performance against the black-box attacks we use (See Table 1).

Original: In Section 3.3, we will provide more experimental results to show that this asymmetric structure performs better than normal convolution and enhances robustness.
Revised: In Section 3.3, we will provide more experimental results to show that this asymmetric structure performs better than normal convolution and enhances robustness.

Original: [Table]
Revised: [Table]

Original: 3.1. R OBUSTNESS TO R ANDOM N OISE
Revised: 3.1. R OBUSTNESS TO R ANDOM N OISE

Original: Beside the robustness against black-box attack, we also evaluate the robustness to random noise.
Revised: Beside the robustness against black-box attack, we also evaluate the robustness to random noise.

Original: Note that although traditional network structures are vulnerable to adversarial examples, they are still robust to the images perturbed with small Gaussian noises.
Revised: Note that although traditional network structures are vulnerable to adversarial examples, they are still robust to the images perturbed with small Gaussian noises.

Original: To see whether our structure also enjoys such property, or even has better robustness in this sense, we feed input images with random Gaussian noises to networks with
Revised: To see whether our structure also enjoys such property, or even has better robustness in this sense, we feed input images with random Gaussian noises to networks with

Original: Random Mask.
Revised: Random Mask.

Original: More speciﬁcally, in order to obtain noises of scales similar to the adversarial perturbations, we generate i.i.d.
Revised: More speciﬁcally, in order to obtain noises of scales similar to the adversarial perturbations, we generate i.i.d.

Original: Gaussian random variables x ∼ N (0 , σ 2 ) , where σ ∈ { 1 , 2 , 4 , 8 , 12 , 16 , 20 , 24 , 28 , 32 } , clip them to the range [ − 2 σ, 2 σ ] and then add them to every pixel of the input image.
Revised: Gaussian random variables x ∼ N (0 , σ 2 ) , where σ ∈ { 1 , 2 , 4 , 8 , 12 , 16 , 20 , 24 , 28 , 32 } , clip them to the range [ − 2 σ, 2 σ ] and then add them to every pixel of the input image.

Original: The results of the experiments are shown in Figure 4.
Revised: The results of the experiments are shown in Figure 4.

Original: We can see that networks with Random Mask always have higher accuracy a normal network.
Revised: We can see that networks with Random Mask always have higher accuracy a normal network.

Original: 3. A DVERSARIAL E XAMPLES ?
Revised: 3. A DVERSARIAL E XAMPLES ?

Original: We evaluate the performance of CNNs with Random Mask under white-box attack (See Appendix F.3).
Revised: We evaluate the performance of CNNs with Random Mask under white-box attack (See Appendix F.3).

Original: With neither obfuscated gradient nor gradient masking, Random Mask can still improve defense performance under various kinds of white-box attack.
Revised: With neither obfuscated gradient nor gradient masking, Random Mask can still improve defense performance under various kinds of white-box attack.

Original: Also, by checking adversarial images that are misclassiﬁed by our network, we ﬁnd most of them have vague edges and can hardly be recognized by humans .
Revised: Also, by checking adversarial images that are misclassiﬁed by our network, we ﬁnd most of them have vague edges and can hardly be recognized by humans .

Original: This result coincides with the theoretical analysis in Shafahi et al.
Revised: This result coincides with the theoretical analysis in Shafahi et al.

Original: ; Fawzi et al.
Revised: ; Fawzi et al.

Original: (2018) that real adversarial examples may be inevitable in some way.
Revised: (2018) that real adversarial examples may be inevitable in some way.

Original: See Appendix E.2 for a randomly selected set of them.
Revised: See Appendix E.2 for a randomly selected set of them.

Original: In contrast, adversarial examples generated against normal CNNs are more like simply adding some non-sense noise which can be ignored by human.
Revised: In contrast, adversarial examples generated against normal CNNs are more like simply adding some non-sense noise which can be ignored by human.

Original: This phenomenon also demonstrates that Random Mask really helps networks to catch more information related to real human perception.
Revised: This phenomenon also demonstrates that Random Mask really helps networks to catch more information related to real human perception.

Original: Moreover, just as Figure 1 shows, with the help of Random Mask, we are able to ﬁnd small perturbations that can actually change the semantic meaning of images for humans.
Revised: Moreover, just as Figure 1 shows, with the help of Random Mask, we are able to ﬁnd small perturbations that can actually change the semantic meaning of images for humans.

Original: So should we still call them “adversarial examples”?
Revised: So should we still call them “adversarial examples”?

Original: How can we get more reasonable deﬁnitions of adversarial examples and robustness?
Revised: How can we get more reasonable deﬁnitions of adversarial examples and robustness?

Original: These questions seem severe due to our ﬁndings.
Revised: These questions seem severe due to our ﬁndings.

Original: 3. P ROPERTIES OF R ANDOM M ASK
Revised: 3. P ROPERTIES OF R ANDOM M ASK

Original: We then show some properties of Random Mask including the appropriate positions to apply Random Mask, the beneﬁt of breaking symmetry, the diversity introduced by randomness and the extensibility of Random
Revised: We then show some properties of Random Mask including the appropriate positions to apply Random Mask, the beneﬁt of breaking symmetry, the diversity introduced by randomness and the extensibility of Random

Original: Mask via structure adjustment and ensemble methods.
Revised: Mask via structure adjustment and ensemble methods.

Original: We conduct a series of comparative experiments and we will continue to use black-box defense performance as a criterion of robustness.
Revised: We conduct a series of comparative experiments and we will continue to use black-box defense performance as a criterion of robustness.

Original: For brevity, we only present the results of a subset of our experiments in Table 2.
Revised: For brevity, we only present the results of a subset of our experiments in Table 2.

Original: Full information on all the experiments can be found in Appendix F.
Revised: Full information on all the experiments can be found in Appendix F.

Original: [Table]
Revised: [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: -Deep
Revised: -Deep

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: -Deep
Revised: -Deep

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: Normal ResNet-18 EN
Revised: Normal ResNet-18 EN

Original: [Table]
Revised: [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: 2 , EN 19.
Revised: 2 , EN 19.

Original: [Table]
Revised: [Table]

Original: Masking Shallow Layers versus Masking Deep Layers.
Revised: Masking Shallow Layers versus Masking Deep Layers.

Original: In the last paragraph of Section 2 , we give an intuition that deep layers in a network should not be masked.
Revised: In the last paragraph of Section 2 , we give an intuition that deep layers in a network should not be masked.

Original: To verify this, we do extensive experiments on
Revised: To verify this, we do extensive experiments on

Original: ResNet-18 with Random Mask applied to different parts.
Revised: ResNet-18 with Random Mask applied to different parts.

Original: We apply Random Mask with different ratios on the shallow blocks and on the deep blocks respectively.
Revised: We apply Random Mask with different ratios on the shallow blocks and on the deep blocks respectively.

Original: Results in Table 2 accord closely with our intuition.
Revised: Results in Table 2 accord closely with our intuition.

Original: masked, we ﬁnd that applying Random Mask to shallow layers enjoys signiﬁcantly lower adversarial attack success rates.
Revised: masked, we ﬁnd that applying Random Mask to shallow layers enjoys signiﬁcantly lower adversarial attack success rates.

Original: This veriﬁes that shallow layers play a more important role in limiting feature extraction than the deep layers.
Revised: This veriﬁes that shallow layers play a more important role in limiting feature extraction than the deep layers.

Original: Moreover, only applying Random Mask on shallow blocks can achieve better performance than applying Random Mask on both shallow and deep blocks, which also veriﬁes our intuition that dropping elements with large receptive ﬁelds is not beneﬁcial for the network.
Revised: Moreover, only applying Random Mask on shallow blocks can achieve better performance than applying Random Mask on both shallow and deep blocks, which also veriﬁes our intuition that dropping elements with large receptive ﬁelds is not beneﬁcial for the network.

Original: In addition, we would like to point out that ResNet-18 with Random Mask signiﬁcantly outperforms the normal network in terms of robustness .
Revised: In addition, we would like to point out that ResNet-18 with Random Mask signiﬁcantly outperforms the normal network in terms of robustness .

Original: Random Mask versus Channel Mask.
Revised: Random Mask versus Channel Mask.

Original: As our Random Mask applies independent random masks to different channels in a layer, we actually break the symmetry of the original CNN structure.
Revised: As our Random Mask applies independent random masks to different channels in a layer, we actually break the symmetry of the original CNN structure.

Original: To see whether this asymmetric structure would help, we try to directly drop whole channels instead of neurons using the same drop ratio as the Random Mask and train it to see the performance.
Revised: To see whether this asymmetric structure would help, we try to directly drop whole channels instead of neurons using the same drop ratio as the Random Mask and train it to see the performance.

Original: This channel mask does not hurt the symmetry while also leading to the same decrease in convolutional operations.
Revised: This channel mask does not hurt the symmetry while also leading to the same decrease in convolutional operations.

Original: Table 2 shows that although our Random Mask network suffers a small drop in test accuracy due to the high drop ratio, we have a great gain in the robustness, compared with the channel-masking network.
Revised: Table 2 shows that although our Random Mask network suffers a small drop in test accuracy due to the high drop ratio, we have a great gain in the robustness, compared with the channel-masking network.

Original: Random Mask versus Same Mask.
Revised: Random Mask versus Same Mask.

Original: The randomness in generating masks in different channels and layers allows each convolutional ﬁlter to focus on different patterns of feature distribution.
Revised: The randomness in generating masks in different channels and layers allows each convolutional ﬁlter to focus on different patterns of feature distribution.

Original: We show the essentialness of generating various masks per layer via experiments that compare Random Mask to a method that only randomly generates one mask per layer and uses it in every channel.
Revised: We show the essentialness of generating various masks per layer via experiments that compare Random Mask to a method that only randomly generates one mask per layer and uses it in every channel.

Original: Table 2 shows that applying the same mask to each channel will decrease the test accuracy.
Revised: Table 2 shows that applying the same mask to each channel will decrease the test accuracy.

Original: This may result from the limitation of expressivity due to the monotone masks at every masked layer.
Revised: This may result from the limitation of expressivity due to the monotone masks at every masked layer.

Original: In fact, we can illustrate such limitation using simple calculations.
Revised: In fact, we can illustrate such limitation using simple calculations.

Original: Since the ﬁlters in our base network ResNet-18 is of size 3 × 3 , each element of the feature maps after the ﬁrst convolutional layer can extract features from at most 9 pixels in the original image.
Revised: Since the ﬁlters in our base network ResNet-18 is of size 3 × 3 , each element of the feature maps after the ﬁrst convolutional layer can extract features from at most 9 pixels in the original image.

Original: This means that if we use the same mask and the drop ratio is 90% , only at most 9 × 10% of the input image can be caught by the convolutional layer, which would cause severe loss of input information.
Revised: This means that if we use the same mask and the drop ratio is 90% , only at most 9 × 10% of the input image can be caught by the convolutional layer, which would cause severe loss of input information.

Original: Increase the Number of Channels.
Revised: Increase the Number of Channels.

Original: In order to compensate the loss of masking many neurons in each channel, it is reasonable that we may need more convolutional ﬁlters for feature extraction.
Revised: In order to compensate the loss of masking many neurons in each channel, it is reasonable that we may need more convolutional ﬁlters for feature extraction.

Original: Therefore, we try to increase the number of channels at masked layers.
Revised: Therefore, we try to increase the number of channels at masked layers.

Original: Table 2 shows that despite ResNet-18 is a well-designed network structure, increasing channels does help the network with Random Mask to get higher test accuracy while maintaining good robustness performance.
Revised: Table 2 shows that despite ResNet-18 is a well-designed network structure, increasing channels does help the network with Random Mask to get higher test accuracy while maintaining good robustness performance.

Original: Ensemble Methods.
Revised: Ensemble Methods.

Original: Thanks to the diversity of Random Mask, we may directly use several networks with the same structure but different Random Masks and ensemble them.
Revised: Thanks to the diversity of Random Mask, we may directly use several networks with the same structure but different Random Masks and ensemble them.

Original: Table 2 shows that such ensemble methods can improve a network with Random Mask in both test accuracy and robustness.
Revised: Table 2 shows that such ensemble methods can improve a network with Random Mask in both test accuracy and robustness.

Original:  C ONCLUSION AND FUTURE DIRECTIONS
Revised:  C ONCLUSION AND FUTURE DIRECTIONS

Original: In conclusion, we introduce and experiment on Random Mask, a modiﬁcation of existing CNNs that makes
Revised: In conclusion, we introduce and experiment on Random Mask, a modiﬁcation of existing CNNs that makes

Original: CNNs capture more information including the pattern of feature distribution.
Revised: CNNs capture more information including the pattern of feature distribution.

Original: We show that CNNs with
Revised: We show that CNNs with

Original: Random Mask can achieve much better robustness while maintaining high test accuracy.
Revised: Random Mask can achieve much better robustness while maintaining high test accuracy.

Original: More speciﬁcally, by using Random Mask, we reach state-of-the-art performance in several black-box defense settings.
Revised: More speciﬁcally, by using Random Mask, we reach state-of-the-art performance in several black-box defense settings.

Original: Another insight resulting from our experiments is that the adversarial examples generated against CNNs with Random
Revised: Another insight resulting from our experiments is that the adversarial examples generated against CNNs with Random

Original: Mask actually change the semantic information of images and can even “fool” humans.
Revised: Mask actually change the semantic information of images and can even “fool” humans.

Original: We hope that this ﬁnding can inspire more people to rethink adversarial examples and the robustness of neural networks.
Revised: We hope that this ﬁnding can inspire more people to rethink adversarial examples and the robustness of neural networks.

Original: B A TTACK APPROACHES
Revised: B A TTACK APPROACHES

Original: We ﬁrst give an overview of how to attack a neural network in some mathematical notations.
Revised: We ﬁrst give an overview of how to attack a neural network in some mathematical notations.

Original: Let x be the input to the neural network and f θ be the function which represents the neural network with parameter θ .
Revised: Let x be the input to the neural network and f θ be the function which represents the neural network with parameter θ .

Original: The output label of the network to the input can be computed as c = arg max i f θ ( x ) .
Revised: The output label of the network to the input can be computed as c = arg max i f θ ( x ) .

Original: In order to perform an adversarial attack, we add a small perturbation δ x to the original image and get an adversarial image x adv = x + δ x .
Revised: In order to perform an adversarial attack, we add a small perturbation δ x to the original image and get an adversarial image x adv = x + δ x .

Original: The new input x adv should look visually similar to the original x .
Revised: The new input x adv should look visually similar to the original x .

Original: Here we use the commonly used (cid:96) ∞ -norm metric to measure similarity, i.e., we require that || δ x || ≤ (cid:15) .
Revised: Here we use the commonly used (cid:96) ∞ -norm metric to measure similarity, i.e., we require that || δ x || ≤ (cid:15) .

Original: The attack is considered successful if the predicted label of the perturbed image c adv = arg max i f θ ( x adv ) is different from c .
Revised: The attack is considered successful if the predicted label of the perturbed image c adv = arg max i f θ ( x adv ) is different from c .

Original: Generally speaking, there are two types of attack methods: Targeted Attack , which aims to change the output label of an image to a speciﬁc (and different) one, and Untargeted Attack , which only aims to change the output label and does not restrict which speciﬁc label the modiﬁed example should let the network output.
Revised: Generally speaking, there are two types of attack methods: Targeted Attack , which aims to change the output label of an image to a speciﬁc (and different) one, and Untargeted Attack , which only aims to change the output label and does not restrict which speciﬁc label the modiﬁed example should let the network output.

Original: In this paper, we mainly use the following three attack approaches.
Revised: In this paper, we mainly use the following three attack approaches.

Original: J denotes the loss function of the neural network and y denotes the true label of x .
Revised: J denotes the loss function of the neural network and y denotes the true label of x .

Original: • Fast Gradient Sign Method (FGSM).
Revised: • Fast Gradient Sign Method (FGSM).

Original: FGSM (Goodfellow et al., 2015) is a one-step untargeted method which generates the adversarial example x adv by adding the sign of the gradients multiplied by a step size (cid:15) to the original benign image x .
Revised: FGSM (Goodfellow et al., 2015) is a one-step untargeted method which generates the adversarial example x adv by adding the sign of the gradients multiplied by a step size (cid:15) to the original benign image x .

Original: Note that FGSM controls the (cid:96) ∞ -norm between the adversarial example and the original one by the parameter (cid:15) .
Revised: Note that FGSM controls the (cid:96) ∞ -norm between the adversarial example and the original one by the parameter (cid:15) .

Original: [Equation]
Revised: [Equation]

Original: • Basic iterative method (PGD).
Revised: • Basic iterative method (PGD).

Original: PGD is a multiple-step attack method which applies FGSM multiple times.
Revised: PGD is a multiple-step attack method which applies FGSM multiple times.

Original: To make the adversarial example still stay “close” to the original image, the image is projected to the (cid:96) ∞ -ball centered at the original image after every step.
Revised: To make the adversarial example still stay “close” to the original image, the image is projected to the (cid:96) ∞ -ball centered at the original image after every step.

Original: The radius of the (cid:96) ∞ -ball is called perturbation scale and is denoted by α .
Revised: The radius of the (cid:96) ∞ -ball is called perturbation scale and is denoted by α .

Original: [Equation]
Revised: [Equation]

Original: • CW Attack.
Revised: • CW Attack.

Original: Carlini & Wagner (2016) shows that constructing an adversarial example can be formulated as solving the following optimization problem
Revised: Carlini & Wagner (2016) shows that constructing an adversarial example can be formulated as solving the following optimization problem

Original: [Equation]
Revised: [Equation]

Original: where c · g ( x (cid:48) ) is the loss function that evaluates the quality of x (cid:48) as an adversarial example and the term
Revised: where c · g ( x (cid:48) ) is the loss function that evaluates the quality of x (cid:48) as an adversarial example and the term

Original: || x (cid:48) − x || 22 controls the scale of the perturbation.
Revised: || x (cid:48) − x || 22 controls the scale of the perturbation.

Original: More speciﬁcally, in the untargeted attack setting, the loss function g ( x ) can be deﬁned as:
Revised: More speciﬁcally, in the untargeted attack setting, the loss function g ( x ) can be deﬁned as:

Original: [Equation]
Revised: [Equation]

Original: where the parameter κ is called conﬁdence.
Revised: where the parameter κ is called conﬁdence.

Original: C N ETWORK A RCHITECTURES
Revised: C N ETWORK A RCHITECTURES

Original: Here we brieﬂy introduce the network architectures used in our experiments.
Revised: Here we brieﬂy introduce the network architectures used in our experiments.

Original: Generally, we apply Random
Revised: Generally, we apply Random

Original: Mask at the shallow layers of the networks and we have tried ﬁve different architectures, namely ResNet-18 ,
Revised: Mask at the shallow layers of the networks and we have tried ﬁve different architectures, namely ResNet-18 ,

Original: ResNet-50 , DenseNet-121 SENet-18 and VGG-19 .
Revised: ResNet-50 , DenseNet-121 SENet-18 and VGG-19 .

Original: We next illustrate these architectures and show how we apply Random Mask to them.
Revised: We next illustrate these architectures and show how we apply Random Mask to them.

Original: C. R ES N ET - 
Revised: C. R ES N ET -

Original: ResNet-18 (He et al., 2016) contains 5 blocks: the 0 th block is one single 3 × 3 convolutional layer, and each of the rest contains four 3 × 3 convolutional layers.
Revised: ResNet-18 (He et al., 2016) contains 5 blocks: the 0 th block is one single 3 × 3 convolutional layer, and each of the rest contains four 3 × 3 convolutional layers.

Original: Figure 6 shows the whole structure of ResNet-18.
Revised: Figure 6 shows the whole structure of ResNet-18.

Original: In our experiment, applying Random Mask to a block means applying Random Mask to every layer in it.
Revised: In our experiment, applying Random Mask to a block means applying Random Mask to every layer in it.

Original: [Figure]
Revised: [Figure]

Original: Similar to ResNet-18, ResNet-50 (He et al., 2016) contains 5 blocks and each block contains several 1 ×and 3 × 3 convolutional layers (i.e. Bottlenecks).
Revised: Similar to ResNet-18, ResNet-50 (He et al., 2016) contains 5 blocks and each block contains several 1 ×and 3 × 3 convolutional layers (i.e. Bottlenecks).

Original: In our experiment, we apply Random Mask to the 3 ×convolutional layers in the ﬁrst three “shallow” blocks.
Revised: In our experiment, we apply Random Mask to the 3 ×convolutional layers in the ﬁrst three “shallow” blocks.

Original: The masked layers in the 1 st block are marked by the red arrows.
Revised: The masked layers in the 1 st block are marked by the red arrows.

Original: [Figure]
Revised: [Figure]

Original: DenseNet-121 (Huang et al., 2017) is another popular network architecture in deep learning researches.
Revised: DenseNet-121 (Huang et al., 2017) is another popular network architecture in deep learning researches.

Original: It contains 5 Dense-Blocks, each of which contains several 1 × 1 and 3 × 3 convolutional layers.
Revised: It contains 5 Dense-Blocks, each of which contains several 1 × 1 and 3 × 3 convolutional layers.

Original: Similar to what we do for ResNet-50, we apply Random Mask to the 3 × 3 convolutional layers in the ﬁrst three “shallow” blocks.
Revised: Similar to what we do for ResNet-50, we apply Random Mask to the 3 × 3 convolutional layers in the ﬁrst three “shallow” blocks.

Original: The growth rate is set to 32 in our experiments.
Revised: The growth rate is set to 32 in our experiments.

Original: [Figure]
Revised: [Figure]

Original: SENet (Hu et al., 2017a), a network architecture which won the ﬁrst place in ImageNet contest 2017 , is shown in Figure 9.
Revised: SENet (Hu et al., 2017a), a network architecture which won the ﬁrst place in ImageNet contest 2017 , is shown in Figure 9.

Original: Note that here we use the pre-activation shortcut version of SENet and we apply Random
Revised: Note that here we use the pre-activation shortcut version of SENet and we apply Random

Original: Mask to the convolutional layers in the ﬁrst 3 SE-blocks.
Revised: Mask to the convolutional layers in the ﬁrst 3 SE-blocks.

Original: [Figure]
Revised: [Figure]

Original: VGG-19 (Simonyan & Zisserman, 2014) is a typical neural network architecture with sixteen 3 × 3 convolutional layers and three fully-connected layers.
Revised: VGG-19 (Simonyan & Zisserman, 2014) is a typical neural network architecture with sixteen 3 × 3 convolutional layers and three fully-connected layers.

Original: We slightly modiﬁed the architecture by replacing the ﬁnalfully connected layers with 1 fully connected layer as is suggested by recent architectures.
Revised: We slightly modiﬁed the architecture by replacing the ﬁnalfully connected layers with 1 fully connected layer as is suggested by recent architectures.

Original: We apply Random
Revised: We apply Random

Original: Mask on the ﬁrst four 3 × 3 convolutional layers.
Revised: Mask on the ﬁrst four 3 × 3 convolutional layers.

Original: D T RAINING P ROCESS ON CIFAR-10 AND MNIST
Revised: D T RAINING P ROCESS ON CIFAR-10 AND MNIST

Original: To guarantee our experiments are reproducible, here we present more details on the training process in our experiments.
Revised: To guarantee our experiments are reproducible, here we present more details on the training process in our experiments.

Original: When training models on CIFAR-10, we ﬁrst subtract per-pixel mean.
Revised: When training models on CIFAR-10, we ﬁrst subtract per-pixel mean.

Original: Then we apply a zero-padding of width 4 , a random horizontal ﬂip and a random crop of size 32 × 32 on train data.
Revised: Then we apply a zero-padding of width 4 , a random horizontal ﬂip and a random crop of size 32 × 32 on train data.

Original: No other data augmentation method is used.
Revised: No other data augmentation method is used.

Original: We apply SGD with momentum parameter 0 .
Revised: We apply SGD with momentum parameter 0 .

Original: 9 , weight decay parameter 5 × 10 − 4 and mini-batch size 128 to train on the data for 350 epochs.
Revised: 9 , weight decay parameter 5 × 10 − 4 and mini-batch size 128 to train on the data for 350 epochs.

Original: The learning rate starts from 0 .
Revised: The learning rate starts from 0 .

Original: and is divided by 10 when the number of epochs reaches 150 and 250 .
Revised: and is divided by 10 when the number of epochs reaches 150 and 250 .

Original: When training models on MNIST, we ﬁrst subtract per-pixel mean.
Revised: When training models on MNIST, we ﬁrst subtract per-pixel mean.

Original: Then we apply random horizontal ﬂip on train data.
Revised: Then we apply random horizontal ﬂip on train data.

Original: We apply SGD with momentum parameter 0 .
Revised: We apply SGD with momentum parameter 0 .

Original: 9 , weight decay parameter 5 × 10 − 4 and mini-batch size 128 to train on the data for 50 epochs.
Revised: 9 , weight decay parameter 5 × 10 − 4 and mini-batch size 128 to train on the data for 50 epochs.

Original: The learning rate starts from 0 .
Revised: The learning rate starts from 0 .

Original: and is divided by 10 when the number of epochs reaches 20 and 40 .
Revised: and is divided by 10 when the number of epochs reaches 20 and 40 .

Original: Figureshows the train and test curves of a normal ResNet-18 and a Random Masked ResNet-18 on CIFAR-10 and
Revised: Figureshows the train and test curves of a normal ResNet-18 and a Random Masked ResNet-18 on CIFAR-10 and

Original: MNIST.
Revised: MNIST.

Original: Different network structures share similar tendency in terms of the train and test curves.
Revised: Different network structures share similar tendency in terms of the train and test curves.

Original: [Figure]
Revised: [Figure]

Original: E A DVERSARIAL E XAMPLES G ENERATED BY A PPLYING R ANDOM M ASK E. A DVERSARIAL E XAMPLES THAT C AN “F OOL ” H UMAN
Revised: E A DVERSARIAL E XAMPLES G ENERATED BY A PPLYING R ANDOM M ASK E. A DVERSARIAL E XAMPLES THAT C AN “F OOL ” H UMAN

Original: Figure 12 shows some adversarial examples generated from CIFAR-10 along with the corresponding original images.
Revised: Figure 12 shows some adversarial examples generated from CIFAR-10 along with the corresponding original images.

Original: These examples are generated from CIFAR-10 against ResNet-18 with Random Mask of drop ratio 0 .
Revised: These examples are generated from CIFAR-10 against ResNet-18 with Random Mask of drop ratio 0 .

Original: 8 on the 0 th , 1 st , 2 nd blocks and another ResNet-18 with Random Mask of drop ratio 0 .
Revised: 8 on the 0 th , 1 st , 2 nd blocks and another ResNet-18 with Random Mask of drop ratio 0 .

Original: 9 on the 1 st , 2 nd blocks.
Revised: 9 on the 1 st , 2 nd blocks.

Original: We use attack method PGD with perturbation scale α = 16 and α = 32 .
Revised: We use attack method PGD with perturbation scale α = 16 and α = 32 .

Original: We also show some adversarial examples generated from Tiny-ImageNet 1 along with the corresponding original images in Figure 13.
Revised: We also show some adversarial examples generated from Tiny-ImageNet 1 along with the corresponding original images in Figure 13.

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: E. R ANDOMLY S ELECTED A DVERSARIAL E XAMPLES
Revised: E. R ANDOMLY S ELECTED A DVERSARIAL E XAMPLES

Original: See Figure 15 for a randomly sampled set of images from Tiny-ImageNet along with the corresponding adversarial examples generated against ResNet-18 with Random Mask and normal ResNet-18.
Revised: See Figure 15 for a randomly sampled set of images from Tiny-ImageNet along with the corresponding adversarial examples generated against ResNet-18 with Random Mask and normal ResNet-18.

Original: F M ORE E XPERIMENTAL R ESULTS F. B LACK - BOX D EFENSE UNDER M ADRY ’ S S ETTING
Revised: F M ORE E XPERIMENTAL R ESULTS F. B LACK - BOX D EFENSE UNDER M ADRY ’ S S ETTING

Original: Here we list the black-box settings in Madry’s paper (Madry et al., 2017).
Revised: Here we list the black-box settings in Madry’s paper (Madry et al., 2017).

Original: In their experiments, ResNets are trained by minimizing the following loss:
Revised: In their experiments, ResNets are trained by minimizing the following loss:

Original: [Equation]
Revised: [Equation]

Original: The outer minimization is achieved by gradient descent and the inner maximization is achieved by generating
Revised: The outer minimization is achieved by gradient descent and the inner maximization is achieved by generating

Original: PGD adversarial examples with step size 2 , the number of steps 7 and the perturbation scale 8 .
Revised: PGD adversarial examples with step size 2 , the number of steps 7 and the perturbation scale 8 .

Original: After training, in their black-box attack setting, they generate adversarial examples from naturally trained neural networks and test them on their models.
Revised: After training, in their black-box attack setting, they generate adversarial examples from naturally trained neural networks and test them on their models.

Original: Both FGSM and PGD adversarial examples have step size or perturbation scale 8 and PGD runs for 7 gradient descent steps with step size 2 .
Revised: Both FGSM and PGD adversarial examples have step size or perturbation scale 8 and PGD runs for 7 gradient descent steps with step size 2 .

Original: In Table 1, we apply Random Mask to shallow blocks with drop ratio 0 . 85 .
Revised: In Table 1, we apply Random Mask to shallow blocks with drop ratio 0 . 85 .

Original: The ratio is selected by considering the trade-off of robustness and generalization performance, which is shown in Figure 14.
Revised: The ratio is selected by considering the trade-off of robustness and generalization performance, which is shown in Figure 14.

Original: When doing attacks, we generate the adversarial examples in the same way as Madry’s paper (Madry et al., 2017) does.
Revised: When doing attacks, we generate the adversarial examples in the same way as Madry’s paper (Madry et al., 2017) does.

Original: F. B LACK - BOX D EFENSE OF SEVERAL NETWORK STRUCTURES ON CIFAR-10 AND MNIST
Revised: F. B LACK - BOX D EFENSE OF SEVERAL NETWORK STRUCTURES ON CIFAR-10 AND MNIST

Original: In this part, we apply Random Mask to ﬁve popular network structures - ResNet-18, ResNet-50, DenseNet-121,
Revised: In this part, we apply Random Mask to ﬁve popular network structures - ResNet-18, ResNet-50, DenseNet-121,

Original: SENet-18, VGG-19, and test the black-box defense performance on CIFAR-10 and MNIST datasets.
Revised: SENet-18, VGG-19, and test the black-box defense performance on CIFAR-10 and MNIST datasets.

Original: Since both the intuition (see Section 2) and the extensive experiments (see Section 3.3 and Appendix F.5) show that we should apply Random Mask on the relatively shallow layers of the network structure, we would like to do so in this part of experiments.
Revised: Since both the intuition (see Section 2) and the extensive experiments (see Section 3.3 and Appendix F.5) show that we should apply Random Mask on the relatively shallow layers of the network structure, we would like to do so in this part of experiments.

Original: Illustrations of Random Mask applied to these network structures can be found in Appendix C.
Revised: Illustrations of Random Mask applied to these network structures can be found in Appendix C.

Original: In addition, the detailed experiments on ResNet-18 (See Appendix F.5) show that defense performances are consistent against adversarial examples generated under different settings.
Revised: In addition, the detailed experiments on ResNet-18 (See Appendix F.5) show that defense performances are consistent against adversarial examples generated under different settings.

Original: Therefore, for brevity, we evaluate the defense performance on adversarial examples generated by PGD only in this subsection.
Revised: Therefore, for brevity, we evaluate the defense performance on adversarial examples generated by PGD only in this subsection.

Original: The results can be found in Table 4 and Table 5.
Revised: The results can be found in Table 4 and Table 5.

Original: Networks in the leftmost column are the target models which defend against adversarial examples.
Revised: Networks in the leftmost column are the target models which defend against adversarial examples.

Original: Networks in the ﬁrst row are the source models to generate adversarial examples by PGD.
Revised: Networks in the ﬁrst row are the source models to generate adversarial examples by PGD.

Original: 0.5-shallow and 0.7-shallow mean applying Random Mask with drop ratio 0.5 and 0.7 to the shallow layers of the network structure whose name lies just above them.
Revised: 0.5-shallow and 0.7-shallow mean applying Random Mask with drop ratio 0.5 and 0.7 to the shallow layers of the network structure whose name lies just above them.

Original: The source and target networks are initialized differently if they share the same architecture.
Revised: The source and target networks are initialized differently if they share the same architecture.

Original: All the numbers except the Acc column mean the success rate of defense.
Revised: All the numbers except the Acc column mean the success rate of defense.

Original: The numbers in the Acc column mean the classiﬁcation accuracy of the target model on clean test data.
Revised: The numbers in the Acc column mean the classiﬁcation accuracy of the target model on clean test data.

Original: These results show that Random Mask can consistently improve the black-box defense performance of different network structures.
Revised: These results show that Random Mask can consistently improve the black-box defense performance of different network structures.

Original: [Table]
Revised: [Table]

Original: the source models to generate adversarial examples by PGD.
Revised: the source models to generate adversarial examples by PGD.

Original: PGD runs for 20 steps with step size 1 and perturbation scale 16.
Revised: PGD runs for 20 steps with step size 1 and perturbation scale 16.

Original: 0.5-shallow and 0.7-shallow mean applying Random Mask with drop ratio 0.5 and 0.7 to the shallow layers of the network structure whose name lies just above them.
Revised: 0.5-shallow and 0.7-shallow mean applying Random Mask with drop ratio 0.5 and 0.7 to the shallow layers of the network structure whose name lies just above them.

Original: All the numbers except the Acc column mean the success rate of defense.
Revised: All the numbers except the Acc column mean the success rate of defense.

Original: [Table]
Revised: [Table]

Original: F. W HITE - BOX
Revised: F. W HITE - BOX

Original: See Table 6 for the defense performance of ResNet-18 with Random Mask against white-box attacks on
Revised: See Table 6 for the defense performance of ResNet-18 with Random Mask against white-box attacks on

Original: CIFAR-10 dataset.
Revised: CIFAR-10 dataset.

Original: All the numbers except the Acc column mean the success rate of defense.
Revised: All the numbers except the Acc column mean the success rate of defense.

Original: The results on other network architectures are similar.
Revised: The results on other network architectures are similar.

Original: [Table]
Revised: [Table]

Original: size of all PGD are set to 1.
Revised: size of all PGD are set to 1.

Original: F. T RANSFERABILITY AND G RAY - BOX D EFENSE
Revised: F. T RANSFERABILITY AND G RAY - BOX D EFENSE

Original: Here we show the gray-box defense ability of Random Mask and the transferability of the adversarial examples generated against Random Mask on CIFAR-10 dataset.
Revised: Here we show the gray-box defense ability of Random Mask and the transferability of the adversarial examples generated against Random Mask on CIFAR-10 dataset.

Original: We generate gray-box attacks in the following two ways.
Revised: We generate gray-box attacks in the following two ways.

Original: One way is to generate adversarial examples against one trained neural network and test those images on a network with the same structure but different initialization.
Revised: One way is to generate adversarial examples against one trained neural network and test those images on a network with the same structure but different initialization.

Original: The other way is speciﬁc to our Random
Revised: The other way is speciﬁc to our Random

Original: Mask models.
Revised: Mask models.

Original: We generate adversarial examples on one trained network with Random Mask and test them on a network with the same drop ratio but different Random Mask.
Revised: We generate adversarial examples on one trained network with Random Mask and test them on a network with the same drop ratio but different Random Mask.

Original: In both of these two ways, the adversarial knows some information on the structure of the network, but does not know the parameters of it.
Revised: In both of these two ways, the adversarial knows some information on the structure of the network, but does not know the parameters of it.

Original: To see the transferability of the generated adversarial examples, we also test them on DenseNet-121 and VGG-19.
Revised: To see the transferability of the generated adversarial examples, we also test them on DenseNet-121 and VGG-19.

Original: [Table]
Revised: [Table]

Original: Table 7 shows that Random Mask can also improve the performance under gray-box attacks.
Revised: Table 7 shows that Random Mask can also improve the performance under gray-box attacks.

Original: In addition, we ﬁnd that CNNs with Random Mask have similar performance on adversarial examples generated by our two kinds of gray-box attacks.
Revised: In addition, we ﬁnd that CNNs with Random Mask have similar performance on adversarial examples generated by our two kinds of gray-box attacks.

Original: This phenomenon indicates that CNNs with Random Mask of same ratios have similar properties and catch similar information.
Revised: This phenomenon indicates that CNNs with Random Mask of same ratios have similar properties and catch similar information.

Original: F. F ULL I NFORMATION ON E XPERIMENTS M ENTIONED IN S ECTION 3. 
Revised: F. F ULL I NFORMATION ON E XPERIMENTS M ENTIONED IN S ECTION 3.

Original: In this part, we will show more experimental results on Random Mask using different adversarial examples, different attack methods and different mask settings on ResNet-18.
Revised: In this part, we will show more experimental results on Random Mask using different adversarial examples, different attack methods and different mask settings on ResNet-18.

Original: More speciﬁcally, we choose 5000 test images from CIFAR-10 which are correctly classiﬁed by the original network to generate FGSM and PGD adversarial examples, and 1000 test images for CW attack.
Revised: More speciﬁcally, we choose 5000 test images from CIFAR-10 which are correctly classiﬁed by the original network to generate FGSM and PGD adversarial examples, and 1000 test images for CW attack.

Original: For FGSM, we try step size (cid:15) ∈ { 8 , 16 , 32 } , namely FGSM 8 , FGSM 16 , FGSM 32 , to generate adversarial examples.
Revised: For FGSM, we try step size (cid:15) ∈ { 8 , 16 , 32 } , namely FGSM 8 , FGSM 16 , FGSM 32 , to generate adversarial examples.

Original: For PGD, we have tried more extensive settings.
Revised: For PGD, we have tried more extensive settings.

Original: Let { (cid:15), T, α } be the PGD setting with step size (cid:15) , the number of steps T and the perturbation scale α , then we have tried PGD settings (1 , 8 , 4) , (2 , 4 , 4) , (4 , 2 , 4) , (1 , 12 , 8) , (2 , 6 , 8) , (4 , 3 , 8) , (1 , 20 , 16) , (2 , 10 , 16) , (4 , 5 , 16) , (1 , 40 , 32) , (2 , 20 , 32) , (4 , 10 , 32) to generate PGD adversarial examples.
Revised: Let { (cid:15), T, α } be the PGD setting with step size (cid:15) , the number of steps T and the perturbation scale α , then we have tried PGD settings (1 , 8 , 4) , (2 , 4 , 4) , (4 , 2 , 4) , (1 , 12 , 8) , (2 , 6 , 8) , (4 , 3 , 8) , (1 , 20 , 16) , (2 , 10 , 16) , (4 , 5 , 16) , (1 , 40 , 32) , (2 , 20 , 32) , (4 , 10 , 32) to generate PGD adversarial examples.

Original: From the experimental results, we observe the following phenomena.
Revised: From the experimental results, we observe the following phenomena.

Original: First, we ﬁnd that the larger the perturbation scale is, the stronger the adversarial examples are.
Revised: First, we ﬁnd that the larger the perturbation scale is, the stronger the adversarial examples are.

Original: Second, for a ﬁxed perturbation scale, the smaller the step size is, the more successful the attack is, as it searches the adversarial examples in a more careful way around the original image.
Revised: Second, for a ﬁxed perturbation scale, the smaller the step size is, the more successful the attack is, as it searches the adversarial examples in a more careful way around the original image.

Original: Based on these observation, we only show strong PGD attack results in the Appendix, namely the settings (1 , 20 , 16)
Revised: Based on these observation, we only show strong PGD attack results in the Appendix, namely the settings (1 , 20 , 16)

Original: ( PGD 16 ), (2 , 10 , 16) ( PGD 2 , 16 ) and (1 , 40 , 32) ( PGD 32 ).
Revised: ( PGD 16 ), (2 , 10 , 16) ( PGD 2 , 16 ) and (1 , 40 , 32) ( PGD 32 ).

Original: Nonetheless, our models also perform much better on weak PGD attacks.
Revised: Nonetheless, our models also perform much better on weak PGD attacks.

Original: For CW attack, we have also tried different conﬁdence parameters κ .
Revised: For CW attack, we have also tried different conﬁdence parameters κ .

Original: However, we ﬁnd that for large κ , the algorithm is hard to ﬁnd adversarial examples for some neural networks such as
Revised: However, we ﬁnd that for large κ , the algorithm is hard to ﬁnd adversarial examples for some neural networks such as

Original: VGG because of its logit scale.
Revised: VGG because of its logit scale.

Original: For smaller κ , the adversarial examples have weak transfer ability, which means they can be easily defensed even by normal networks.
Revised: For smaller κ , the adversarial examples have weak transfer ability, which means they can be easily defensed even by normal networks.

Original: Therefore, in order to balance these two factors, we choose κ =
Revised: Therefore, in order to balance these two factors, we choose κ =

Original: Note that the noise of FGSM and PGD is considered in the sense of (cid:96) ∞ norm and the noise of CW is considered in the sense of (cid:96) 2 norm.
Revised: Note that the noise of FGSM and PGD is considered in the sense of (cid:96) ∞ norm and the noise of CW is considered in the sense of (cid:96) 2 norm.

Original: All adversarial examples used to evaluate can fool the original network.
Revised: All adversarial examples used to evaluate can fool the original network.

Original: Table 8,9,10,11 and 12 list our experimental results.
Revised: Table 8,9,10,11 and 12 list our experimental results.

Original: DC means we replace Random Mask with a decreased number of channels in the corresponding blocks to achieve the same drop ratio.
Revised: DC means we replace Random Mask with a decreased number of channels in the corresponding blocks to achieve the same drop ratio.

Original: SM means we use the same mask on all the channels in a layer.
Revised: SM means we use the same mask on all the channels in a layer.

Original: × n means we multiply the number of the channels in the corresponding blocks by n times.
Revised: × n means we multiply the number of the channels in the corresponding blocks by n times.

Original: EN means we ensemble ﬁve models with different masks of the same drop ratio.
Revised: EN means we ensemble ﬁve models with different masks of the same drop ratio.

Original: [Table]
Revised: [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: Normal
Revised: Normal

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: The model trained on CIFAR-10 achieves 95.62% accuracy on test set.
Revised: The model trained on CIFAR-10 achieves 95.62% accuracy on test set.

Original: σ -Shallow DC , σ -Shallow SM , σ -Shallow × n and σ -Shallow EN mean dropping channels with ratio σ , applying same mask with ratio σ , increasing channel number to n times with mask ratio σ for every channel and ensemble ﬁve models with different masks of same ratio σ respectively.
Revised: σ -Shallow DC , σ -Shallow SM , σ -Shallow × n and σ -Shallow EN mean dropping channels with ratio σ , applying same mask with ratio σ , increasing channel number to n times with mask ratio σ for every channel and ensemble ﬁve models with different masks of same ratio σ respectively.

Original: The entries in the middle seven columns are success rates of defense under different settings.
Revised: The entries in the middle seven columns are success rates of defense under different settings.

Original: [Table]
Revised: [Table]

Original: % 36.19% 40.86% 15.52% 73.68% 92.57% 0.7-Shallow SM 80.80% 48.37% 15.26% 53.69% 54.78% 22.90% 82.34% 89.81% 0.9-Shallow SM 69.15% 43.55% 20.26% 50.68% 50.80% 28.82% 71.62% 74.28% 0.5-Shallow ×46.50% 21.37% 6.06% 6.86% 8.65% 3.59% 39.12% 94.12% 0.7-Shallow ×63.37% 29.90% 12.07% 20.70% 24.08% 7.76% 67.02% 93.01% 0.9-Shallow ×84.28% 64.47% 31.90% 62.65% 65.24% 33.06% 85.08% 90.49% 0.9-Shallow ×78.

Revised: % 36.19% 40.86% 15.52% 73.68% 92.57% 0.7-Shallow SM 80.80% 48.37% 15.26% 53.69% 54.78% 22.90% 82.34% 89.81% 0.9-Shallow SM 69.15% 43.55% 20.26% 50.68% 50.80% 28.82% 71.62% 74.28% 0.5-Shallow ×46.50% 21.37% 6.06% 6.86% 8.65% 3.59% 39.12% 94.12% 0.7-Shallow ×63.37% 29.90% 12.07% 20.70% 24.08% 7.76% 67.02% 93.01% 0.9-Shallow ×84.28% 64.47% 31.90% 62.65% 65.24% 33.06% 85.08% 90.49% 0.9-Shallow ×78.

Original: [Table]
Revised: [Table]

Original: Normal ResNet-18 EN 29.66% 14.37% 3.97% 0.98% 1.24% 0.54% 2.00% 96.12% 0.5-Shallow × 2 , EN 49.16% 19.81% 6.73% 7.02% 8.50% 3.46% 38.12% 95.24 % 0.5-Shallow EN 63.38% 30.25% 11.05% 18.15% 21.14% 6.71% 63.90% 94.56% 0.7-Shallow EN 77.25% 50.07% 13.80% 41.59% 44.78% 15.85% 80.86% 93.31% 0.85-Shallow EN
Revised: Normal ResNet-18 EN 29.66% 14.37% 3.97% 0.98% 1.24% 0.54% 2.00% 96.12% 0.5-Shallow × 2 , EN 49.16% 19.81% 6.73% 7.02% 8.50% 3.46% 38.12% 95.24 % 0.5-Shallow EN 63.38% 30.25% 11.05% 18.15% 21.14% 6.71% 63.90% 94.56% 0.7-Shallow EN 77.25% 50.07% 13.80% 41.59% 44.78% 15.85% 80.86% 93.31% 0.85-Shallow EN

Original: [Table]
Revised: [Table]

Original: The model trained on CIFAR-10 achieves 95.27% accuracy on test set.
Revised: The model trained on CIFAR-10 achieves 95.27% accuracy on test set.

Original: σ -Shallow DC , σ -Shallow SM , σ -Shallow × n and σ -Shallow EN mean dropping channels with ratio σ , applying same mask with ratio σ , increasing channel number to n times with mask ratio σ for every channel and ensemble ﬁve models with different masks of same ratio σ respectively.
Revised: σ -Shallow DC , σ -Shallow SM , σ -Shallow × n and σ -Shallow EN mean dropping channels with ratio σ , applying same mask with ratio σ , increasing channel number to n times with mask ratio σ for every channel and ensemble ﬁve models with different masks of same ratio σ respectively.

Original: The entries in the middle seven columns are success rates of defense under different settings.
Revised: The entries in the middle seven columns are success rates of defense under different settings.

Original: [Table]
Revised: [Table]

Original: % 29.83% 33.51% 9.60% 26.65% 92.57% 0.7-Shallow SM 77.25% 44.94% 13.80% 49.52% 51.
Revised: % 29.83% 33.51% 9.60% 26.65% 92.57% 0.7-Shallow SM 77.25% 44.94% 13.80% 49.52% 51.

Original: [Table]
Revised: [Table]

Original: % 21.24% 46.44% 89.81% 0.9-Shallow SM 64.32% 39.76% 19.21% 50.16% 49.15% 28.24% 45.18% 74.28% 0.5-Shallow ×41.51% 18.47% 6.02% 3.67% 4.80% 0.62% 1.32% 94.
Revised: % 21.24% 46.44% 89.81% 0.9-Shallow SM 64.32% 39.76% 19.21% 50.16% 49.15% 28.24% 45.18% 74.28% 0.5-Shallow ×41.51% 18.47% 6.02% 3.67% 4.80% 0.62% 1.32% 94.

Original: [Table] [Table]
Revised: [Table] [Table]

Original: -Shallow ×58.
Revised: -Shallow ×58.

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: Normal
Revised: Normal

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: -Shallow × 2 , EN 44.
Revised: -Shallow × 2 , EN 44.

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: -Shallow EN 59.64% 26.21% 10.17% 11.41% 14.23% 2.48% 8.12% 94.56%
Revised: -Shallow EN 59.64% 26.21% 10.17% 11.41% 14.23% 2.48% 8.12% 94.56%

Original: [Table]
Revised: [Table]

Original: -Shallow EN 73.45% 45.60%
Revised: -Shallow EN 73.45% 45.60%

Original: [Table] [Table]
Revised: [Table] [Table]

Original: -Shallow
Revised: -Shallow

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table]
Revised: [Table]

Original: n and σ -Shallow
Revised: n and σ -Shallow

Original: [Table]
Revised: [Table]

Original: mean dropping channels with ratio σ , applying same mask with ratio σ , increasing channel number to n times with mask ratio σ for every channel and ensemble ﬁve models with different masks of same ratio σ respectively.
Revised: mean dropping channels with ratio σ , applying same mask with ratio σ , increasing channel number to n times with mask ratio σ for every channel and ensemble ﬁve models with different masks of same ratio σ respectively.

Original: The entries in the middle seven columns are success rates of defense under different settings.
Revised: The entries in the middle seven columns are success rates of defense under different settings.

Original: [Table]
Revised: [Table]

Original: % 41.34% 43.00% 16.93% 34.92% 92.57% 0.7-Shallow SM 79.48% 49.66% 15.65% 58.96% 60.00% 26.78% 48.28% 89.81% 0.9-Shallow SM 65.85% 42.59% 21.87% 52.63% 52.91% 30.38% 43.22% 74.28% 0.5-Shallow ×44.

Revised: % 41.34% 43.00% 16.93% 34.92% 92.57% 0.7-Shallow SM 79.48% 49.66% 15.65% 58.96% 60.00% 26.78% 48.28% 89.81% 0.9-Shallow SM 65.85% 42.59% 21.87% 52.63% 52.91% 30.38% 43.22% 74.28% 0.5-Shallow ×44.

Original: % 21.71% 9.49% 8.91% 9.61% 3.47% 2.65% 94.12% 0.7-Shallow ×60.51% 30.89% 11.58% 24.82% 26.79% 8.36% 21.52% 93.01% 0.9-Shallow ×85.
Revised: % 21.71% 9.49% 8.91% 9.61% 3.47% 2.65% 94.12% 0.7-Shallow ×60.51% 30.89% 11.58% 24.82% 26.79% 8.36% 21.52% 93.01% 0.9-Shallow ×85.

Original: [Table]
Revised: [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: 9-Shallow ×78.
Revised: 9-Shallow ×78.

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: Normal ResNet-18 EN 27.87% 17.80% 8.81% 1.02% 1.24% 0.52% 0.00% 96.12% 0.5-Shallow × 2 , EN 45.04% 20.25% 9.69% 7.46% 9.02% 3.30% 2.84% 95.24% 0.5-Shallow EN 60.42% 31.08% 10.77% 20.98% 22.56% 7.09% 13.61% 94.56% 0.7-Shallow EN 76.08% 51.49% 13.19% 46.98% 49.31% 18.95% 39.51% 93.31% 0.85-Shallow EN
Revised: Normal ResNet-18 EN 27.87% 17.80% 8.81% 1.02% 1.24% 0.52% 0.00% 96.12% 0.5-Shallow × 2 , EN 45.04% 20.25% 9.69% 7.46% 9.02% 3.30% 2.84% 95.24% 0.5-Shallow EN 60.42% 31.08% 10.77% 20.98% 22.56% 7.09% 13.61% 94.56% 0.7-Shallow EN 76.08% 51.49% 13.19% 46.98% 49.31% 18.95% 39.51% 93.31% 0.85-Shallow EN

Original: [Table]
Revised: [Table]

Original: The model trained on CIFAR-10 achieves
Revised: The model trained on CIFAR-10 achieves

Original: [Table]
Revised: [Table]

Original: 15% accuracy on test set.
Revised: 15% accuracy on test set.

Original: [Table] [Table]
Revised: [Table] [Table]

Original: , σ -
Revised: , σ -

Original: [Table]
Revised: [Table]

Original: , σ -Shallow × n and σ -Shallow EN mean dropping channels with ratio σ , applying same mask with ratio σ , increasing channel number to n times with mask ratio σ for every channel and ensemble ﬁve models with different masks of same ratio σ respectively.
Revised: , σ -Shallow × n and σ -Shallow EN mean dropping channels with ratio σ , applying same mask with ratio σ , increasing channel number to n times with mask ratio σ for every channel and ensemble ﬁve models with different masks of same ratio σ respectively.

Original: The entries in the middle seven columns are success rates of defense under different settings.
Revised: The entries in the middle seven columns are success rates of defense under different settings.

Original: [Table]
Revised: [Table]

Original: Adversarial examples are generated against VGG-19 .
Revised: Adversarial examples are generated against VGG-19 .

Original: The model trained on CIFAR-10 achieves 94.04% accuracy on test set.
Revised: The model trained on CIFAR-10 achieves 94.04% accuracy on test set.

Original: [Table]
Revised: [Table]

Original: -Shallow DC , σ -Shallow SM , σ -Shallow × n and σ -Shallow EN mean dropping channels with ratio σ ,
Revised: -Shallow DC , σ -Shallow SM , σ -Shallow × n and σ -Shallow EN mean dropping channels with ratio σ ,