text: Networks: We test with four publicly available networks1,2, including Inception-v3 (Szegedy et al., 2016), ResNet-v2 (He et al., 2016b) of 101 layers, Inception-ResNet-v2 (Szegedy et al., 2017), and ens-adv-Inception-ResNet-v2 which applies the ensemble adversarial training (Tramèr et al., 2017) on Inception-ResNet-v2.