Before revision:  Our approach can be adapted to other domains where non-uniform perturbations more accurately represent realistic adversarial examples .
After revision:  Our approach can be adapted to other domains where non-uniform perturbation bounds, and show that non-uniform bounds achieve better certification .