Against the white-box attack Claudini, attackers need to consume about 3 times the FLOPs to reach the same ASR on HoS as on the baselines.