Original: We observe that our method achieves second best overall accuracy (after RFGSM-AT) in most of the cases.
Revised: We observe that our method achieves second best overall accuracy (after RFGSM-AT) in most of the cases.

Original: Althought RFGSM-AT attains the best overall accuracy, it has the least robust accuracy A robust among all the baselines with a notable margin.
Revised: Althought RFGSM-AT attains the best overall accuracy, it has the least robust accuracy A robust among all the baselines with a notable margin.

Original: [Table]
Revised: [Table]

Revised: perturbations

Revised: A robust and (iii) overall accuracy A .

Revised: Here, the adversary adopts uncertainty based subset selection to perform attack, where the true subset chosen for attack S latent consists of top 10% test instances in terms of the uncertainty of a classiﬁer trained on all the clean examples.

Revised: [Table]

Revised: [Table]

Revised: H. E XPERIMENTS ON CIFAR100 WITH R ESNET -9 MODEL

Revised: Here, we present results on CIFAR-100 dataset when the model is Resnet-9.

Revised: We conducted experiments on CIFAR100 for only the top-5 baselines which we found competitive on other datasets.

Original: {+We report the results for PGD and Square attacks in Table 
+}
Revised: {+We report the results for PGD and Square attacks in Table 
+}

Revised: We observe that our method outperforms all the baselines in terms of clean, robust, and overall accuracies.

Revised: [Table]

Revised: H.

Revised: C OMPARISON OF ROBUST ACCURACY SUBJECT TO A MINIMUM OVERALL ACCURACY

Revised: Here, we produce more results related to Table 23.

Revised: Speciﬁcally, we ﬁrst tune the hyperparameters of all the methods to ensure that the overall accuracy of all methods reaches a given threshold and then compare their robustness.

Revised: If P indicates the hyperparameters, then we ﬁnd max P

Revised: A robust ( P ) such that A ( P ) ≥ a for some given a .

Revised: We present the results of CIFAR10 for a = 0 .

Revised: 81 and FMNIST

Revised: for a = 0 . 83 in Table 23 for different attacks.

Revised: For CIFAR10, we ﬁnd that R OGET ( a φ = PGD) is the best performer in terms of robust accuracy and R OGET ( a φ = AdvGAN) is the best performer in terms of overall accuracy (except for MIFGSM attack).

Revised: Moreover, R OGET ( a φ = AdvGAN) is the second-best performer in terms of robust accuracy.

Revised: For FMNIST, R OGET ( a φ = AdvGAN) achieves the highest robust accuracy A robust (except for PGD attack)

Original: [Table]
Revised: [Table]

Revised: H. P ERFORMANCE VARIATION WITH | S LATENT |

Revised: Here, we train both the variants of R OGET using b = 0 .

Revised: 1 | D Tr | and evaluate using different number of instances | S latent | perturbed during test.

Revised: We already reported the results for CIFAR10 in the main.

Revised: In

Revised: Figure 24, we report the results for FMNIST, which show that R OGET ( a φ = AdvGAN) and R OGET ( a φ = PGD) outperform the baselines at the smaller values of | S latent | .

Revised: For larger value of | S latent | , our methods are only being outperformed by the PGD-AT.

Revised: [Figure]

Revised: In the experiments, i.e. , in Figures 5 and 24, we kept the value of ρ same across different values of | S latent | , set by worst case hyperparameter selection with b = 0 .

Revised: | D tr | We observed that our method performed better for smaller values of | S latent | .

Revised: Next, we adjust ρ for different | S latent | with b = | S latent | | D test | | D tr | , i.e. , we provide a little information about the proportion of instances that are going to be attacked.

Revised: Figure 25 summarizes the results which show that R OGET ( a φ = AdvGAN) outperforms the baselines for a wide range of the size of attacked test instances.

Revised: [Figure]

Revised: attacked

Revised: H. P LUGGING OTHER MODELS INTO OUR FRAMEWORK

Revised: Here, we performed experiments where we plugged TRADES loss in the proposed algorithm.

Revised: Results are as follows for CIFAR10 for PGD and Square attack.

Original: [Table]
Revised: [Table]

Revised: We observe that plugging TRADES in our algorithm improves the performance of TRADES in terms of the overall accuracy.

Revised: H. E XPERIMENTS WITH LOSS BASED ATTACK

Revised: Here, we performed the experiments where the adversary chooses instances based on the predicted accuracy.

Revised: The following table summarizes the results for PGD and Square Attacks which show that our methods outperform the existing method in terms of the overall accuracy as well as robust accuracy.

Revised: [Table]