Before revision:  Our approach can be adapted to other domains where non-uniform perturbations more accurately represent realistic adversarial examples .
After revision:  Finally, we present robustness certification utilizing non-uniform perturbations more accurately represent realistic adversarial examples .