Generating Adversarial Examples with Graph Neural Networks (Supplementary material)

We now describe the three models used in this work in greater detail. They have been trained robustly on the CIFAR-10 dataset [Krizhevsky et al., 2009] using the method introduced by Wong and Kolter [2018] to achieve robustness against l∞ perturbations of size up to = 8/255 (the amount typically considered in empirical works). The ‘Base’ and the ‘Wide’ model both have two convolutional layers, followed by two fully connected ones. The ‘Deep’ model has two further convolutional layers. All three networks use ReLU activations and all three models have been used in previous work [Lu and Kumar, 2020, Bunel et al., 2020].