Before revision:  Our approach also universally increases the adversarial accuracy by 0.1\% to 0.3\%  in various state-of-the-art adversarially trained models on the AutoAttack benchmark, where every small margin of improvement is significant.
After revision:  Our approach also universally increases the adversarial accuracy by 0.1\% to 0.3\% points in various state-of-the-art adversarially trained models on the AutoAttack benchmark, where every small margin of improvement is significant.