Before revision:  (b)however, input gradients of adversarially robust models (i.e., trained on adversarially perturbed data)starkly highlight relevant features over irrelevant features. To better understand input gradients, we introduce a synthetic testbed and theoretically justify our counter-intuitive empirical findings .
After revision:  (b)however, input gradients of adversarially robust models satisfy (A) .