Original: Although RFGSM-AT is best in terms of overall accuracy, its robustness is very poor.
Revised: Although RFGSM-AT is best in terms of overall accuracy, its robustness is very poor.

Original: [Table]
Revised: [Table]

Original: H. W ORST - CASE HYPERPARAMETER SETTING FOR FMNIST
Revised: H. W ORST - CASE HYPERPARAMETER SETTING FOR FMNIST

Original: We present the results of worst-case hyperparameter selection for FMNIST in Table 18.
Revised: We present the results of worst-case hyperparameter selection for FMNIST in Table 18.

Original: Here, we achieve the best overall accuracy A for three attacks and second-best overall accuracy for the rest.
Revised: Here, we achieve the best overall accuracy A for three attacks and second-best overall accuracy for the rest.

Original: [Table]
Revised: [Table]

Original: H. E XPERIMENTS ON CIFAR100 WITH R ESNET -
Revised: H

Revised:  E XPERIMENTS ON CIFAR100 WITH R ESNET -

Original: Here, we present results on CIFAR-100 dataset with a Resnet-18 model.
Revised: Here, we present results on CIFAR-100 dataset with a Resnet-18 model.

Original: We conducted experiments on CIFAR100 for only the top-5 baselines which we found competetive on other datasets.
Revised: We conducted experiments on CIFAR100 for only the top-5 baselines which we found competetive on other datasets.

Original: None of the baselines report experiments on CIFAR100.
Revised: None of the baselines report experiments on CIFAR100.

Original: Hence for all the methods (including ours), we keep the hyperparameters same as those used in CIFAR-10.
Revised: Hence for all the methods (including ours), we keep the hyperparameters same as those used in CIFAR-10.

Original: We perform all three hyperparameter selection techniques and report the results in Table 22, 20, and 21.
Revised: We perform all three hyperparameter selection techniques and report the results in Table 19, 20, and 21.

Original: We observe that our method achieves second best overall accuracy (after RFGSM-AT) in most of the cases.
Revised: We observe that our method achieves second best overall accuracy (after RFGSM-AT) in most of the cases.

Original: Althought RFGSM-AT attains the best overall accuracy, it has the least robust accuracy A robust among all the baselines with a notable margin.
Revised: Althought RFGSM-AT attains the best overall accuracy, it has the least robust accuracy A robust among all the baselines with a notable margin.

Original: [Table]
Revised: [Table]

Original:  perturbations
Revised: to the adversarial perturbations

Original: A robust and (iii) overall accuracy A .
Revised: A robust and (iii) overall accuracy A .

Original: Here, the adversary adopts uncertainty based subset selection to perform attack, where the true subset chosen for attack S latent consists of top 10% test instances in terms of the uncertainty of a classiﬁer trained on all the clean examples.
Revised: Here, the adversary adopts uncertainty based subset selection to perform attack, where the true subset chosen for attack S latent consists of top 10% test instances in terms of the uncertainty of a classiﬁer trained on all the clean examples.

Original: [Table] [Table]
Revised: [Table] [Table]

Original: H. E XPERIMENTS ON CIFAR100 WITH R ESNET -9 MODEL
Revised: H. E XPERIMENTS ON CIFAR100 WITH R ESNET -9 MODEL

Original: Here, we present results on CIFAR-100 dataset when the model is Resnet-9.
Revised: Here, we present results on CIFAR-100 dataset when the model is Resnet-9.

Original: We conducted experiments on CIFAR100 for only the top-5 baselines which we found competitive on other datasets.
Revised: We conducted experiments on CIFAR100 for only the top-5 baselines which we found competitive on other datasets.

Original: {+In default hyperparameter setting, we use ρ = 0 . 5 for R OGET ( a φ = PGD) and ρ = 2 . 
 for R OGET ( a φ = AdvGAN) and report the results in Table 22.+} We  report the results for PGD and Square attacks in Table [-
-]
Revised: {+In default hyperparameter setting, we use ρ = 0 . 5 for R OGET ( a φ = PGD) and ρ = 2 . 
 for R OGET ( a φ = AdvGAN) and report the results in Table 22.+} We also report the results of worst-case hyperparameter setting in Table [-
-]23.

Original: We observe that our method outperforms all the baselines in terms of clean, robust, and overall accuracies.
Revised: We observe that our method outperforms all the baselines in terms of clean, robust (except on PGD attack)

Original: [Table]
Revised: [Table]

Original: H.
Revised: and overall accuracies [Table] [Table]

Original: C OMPARISON OF ROBUST ACCURACY SUBJECT TO A MINIMUM OVERALL ACCURACY
Revised: C OMPARISON OF ROBUST ACCURACY SUBJECT TO A MINIMUM OVERALL ACCURACY

Original: Here, we produce more results related to Table 23.
Revised: Here, we produce more results related to Table 24.

Original: Speciﬁcally, we ﬁrst tune the hyperparameters of all the methods to ensure that the overall accuracy of all methods reaches a given threshold and then compare their robustness.
Revised: Speciﬁcally, we ﬁrst tune the hyperparameters of all the methods to ensure that the overall accuracy of all methods reaches a given threshold and then compare their robustness.

Original: If P indicates the hyperparameters, then we ﬁnd max P
Revised: If P indicates the hyperparameters, then we ﬁnd max P

Original: A robust ( P ) such that A ( P ) ≥ a for some given a .
Revised: A robust ( P ) such that A ( P ) ≥ a for some given a .

Original: We present the results of CIFAR10 for a = 0 .
Revised: We present the results of CIFAR10 for a = 0 .

Original: 81 and FMNIST
Revised: 81 and FMNIST

Original: for a = 0 . 83 in Table 23 for different attacks.
Revised: for a = 0 . 83 in Table 24 for different attacks.

Original: For CIFAR10, we ﬁnd that R OGET ( a φ = PGD) is the best performer in terms of robust accuracy and R OGET ( a φ = AdvGAN) is the best performer in terms of overall accuracy (except for MIFGSM attack).
Revised: For CIFAR10, we ﬁnd that R OGET ( a φ = PGD) is the best performer in terms of robust accuracy and R OGET ( a φ = AdvGAN) is the best performer in terms of overall accuracy (except for MIFGSM attack).

Original: Moreover, R OGET ( a φ = AdvGAN) is the second-best performer in terms of robust accuracy.
Revised: Moreover, R OGET ( a φ = AdvGAN) is the second-best performer in terms of robust accuracy.

Original: For FMNIST, R OGET ( a φ = AdvGAN) achieves the highest robust accuracy A robust (except for PGD attack)
Revised: For FMNIST, R OGET ( a φ = AdvGAN) achieves the highest robust accuracy A robust (except for PGD attack).

Original: [Table]
Revised: [Table]

Original: H. P ERFORMANCE VARIATION WITH | S LATENT |
Revised: P ERFORMANCE VARIATION WITH | S LATENT |

Original: Here, we train both the variants of R OGET using b = 0 .
Revised: Here, we train both the variants of R OGET using b = 0 .

Original: 1 | D Tr | and evaluate using different number of instances | S latent | perturbed during test.
Revised: 1 | D Tr | and evaluate using different number of instances | S latent | perturbed during test.

Original: We already reported the results for CIFAR10 in the main.
Revised: We already reported the results for CIFAR10 in the main.

Original: In
Revised: In

Original: Figure 24, we report the results for FMNIST, which show that R OGET ( a φ = AdvGAN) and R OGET ( a φ = PGD) outperform the baselines at the smaller values of | S latent | .
Revised: Figure 25, we report the results for FMNIST, which show that R OGET ( a φ = AdvGAN) and R OGET ( a φ = PGD) outperform the baselines at the smaller values of | S latent | .

Original: For larger value of | S latent | , our methods are only being outperformed by the PGD-AT.
Revised: For larger value of | S latent | , our methods are only being outperformed by the PGD-AT.

Original: [Figure]
Revised: [Figure]

Original: In the experiments, i.e. , in Figures 5 and 24, we kept the value of ρ same across different values of | S latent | , set by worst case hyperparameter selection with b = 0 .
Revised: In the experiments, i.e. , in Figures 5 and 25, we kept the value of ρ same across different values of | S latent | , set by worst case hyperparameter selection with b = 0 .

Original: | D tr | We observed that our method performed better for smaller values of | S latent | .
Revised: | D tr | We observed that our method performed better for smaller values of | S latent | .

Original: Next, we adjust ρ for different | S latent | with b = | S latent | | D test | | D tr | , i.e. , we provide a little information about the proportion of instances that are going to be attacked.
Revised: Next, we adjust ρ for different | S latent | with b = | S latent | | D test | | D tr | , i.e. , we provide a little information about the proportion of instances that are going to be attacked.

Original: Figure 25 summarizes the results which show that R OGET ( a φ = AdvGAN) outperforms the baselines for a wide range of the size of attacked test instances.
Revised: Figure 26 summarizes the results which show that R OGET ( a φ = AdvGAN) outperforms the baselines for a wide range of the size of attacked test instances.

Original: [Figure]
Revised: [Figure]

Original: attacked

Original: H. P LUGGING OTHER MODELS INTO OUR FRAMEWORK

Original: Here, we performed experiments where we plugged TRADES loss in the proposed algorithm.
Revised: Here, we performed experiments where we plugged TRADES loss in the proposed algorithm.

Original: Results are as follows for CIFAR10 for PGD and Square attack.
Revised: Results are as follows for CIFAR10 for PGD and Square attack.

Original: [Table]
Revised: [Table]

Original: We observe that plugging TRADES in our algorithm improves the performance of TRADES in terms of the overall accuracy.
Revised: We observe that plugging TRADES in our algorithm improves the performance of TRADES in terms of the overall accuracy.

Original: H. E XPERIMENTS WITH LOSS BASED ATTACK
Revised: H. E XPERIMENTS WITH LOSS BASED ATTACK

Original: Here, we performed the experiments where the adversary chooses instances based on the predicted accuracy.
Revised: Here, we performed the experiments where the adversary chooses instances based on the predicted accuracy.

Original: The following table summarizes the results for PGD and Square Attacks which show that our methods outperform the existing method in terms of the overall accuracy as well as robust accuracy.
Revised: The following table summarizes the results for PGD and Square Attacks which show that our methods outperform the existing method in terms of the overall accuracy as well as robust accuracy.

Original: [Table]
Revised: [Table]