Original: We attack on this set for all the methods and show the results in Table
Revised: We attack on this set for all the methods and show the results in Table

Original: [Table]
Revised: [Table]

Original: We observe that our method makes a good trade-off between accuracy and robustness.
Revised: We observe that our method makes a good trade-off between accuracy and robustness.

Original: Although RFGSM-AT is best in terms of overall accuracy, its robustness is very poor.
Revised: Although RFGSM-AT is best in terms of overall accuracy, its robustness is very poor.

Original: [Table]
Revised: [Table]

Original: H. W ORST - CASE HYPERPARAMETER SETTING FOR FMNIST
Revised: H. W ORST - CASE HYPERPARAMETER SETTING FOR FMNIST

Original: We present the results of worst-case hyperparameter selection for FMNIST in Table 18.
Revised: We present the results of worst-case hyperparameter selection for FMNIST in Table 18.

Original: Here, we achieve the best overall accuracy A for three attacks and second-best overall accuracy for the rest.
Revised: Here, we achieve the best overall accuracy A for three attacks and second-best overall accuracy for the rest.

Original: [Table]
Revised: [Table]

Original: H 
Revised: H. E XPERIMENTS ON CIFAR

Original: E XPERIMENTS ON CIFAR100 WITH R ESNET -

Original: Here, we present results on CIFAR-100 dataset with a Resnet-18 model.
Revised: Here, we present results on CIFAR-100 dataset. Here, the model is Resnet-9.

Original: We conducted experiments on CIFAR100 for only the top-5 baselines which we found competetive on other datasets.
Revised: We conducted experiments on CIFAR100 for only the top-5 baselines which we found competitive on other datasets.

Original: None of the baselines report experiments on CIFAR100. Hence for all the methods (including ours), we keep the hyperparameters same as those used in CIFAR-10. We perform all three hyperparameter selection techniques and report the results in Table 19, 20, and 21.
Revised: In default hyperparameter setting, we use ρ = 0 .

Original: We observe that our method achieves second best overall accuracy (after RFGSM-AT) in most of the cases. Althought RFGSM-AT attains the best overall accuracy, it has the least robust accuracy A robust among all the baselines with a notable margin. [Table] to the adversarial perturbations{+φ = PGD) and ρ = 2 . 
+}
Revised: 5 for R OGET ( a {+φ = PGD) and ρ = 2 . 
+}

Original: A robust and (iii) overall accuracy A . Here, the adversary adopts uncertainty based subset selection to perform attack, where the true subset chosen for attack S latent consists of top 10% test instances in terms of the uncertainty of a classiﬁer trained on all the clean examples. [Table] [Table]
Revised: for R OGET ( a φ = AdvGAN) .

Original: Here, we present results on CIFAR-100 dataset when the model is Resnet-9. We conducted experiments on CIFAR100 for only the top-5 baselines which we found competitive on other datasets. In default hyperparameter setting, we use ρ = 0 .
Revised: For the baselines, we choose the same default hyperparameters as in CIFAR10.

Original: [-5 for R OGET ( a φ = PGD) and ρ = 2 . 
 for R OGET ( a φ = AdvGAN) and report the-] results  in Table 22.
Revised: [-5 for R OGET ( a φ = PGD) and ρ = 2 . 
 for R OGET ( a φ = AdvGAN) and report the-]The results can be seen in Table 19.

Original: We also report the results of worst-case hyperparameter setting in Table 23.
Revised: We also report the results of worst-case hyperparameter setting in Table 20.

Original: We observe that our method outperforms all the baselines in terms of clean, robust (except on PGD attack) [Table] and overall accuracies
Revised: We observe that our method outperforms all the baselines in terms of clean, robust (except on PGD attack), and overall accuracies.

Original: [Table]
Revised: [Table]

Original: [Table]
Revised: [Table]

Original: C OMPARISON OF ROBUST ACCURACY SUBJECT TO A MINIMUM OVERALL ACCURACY
Revised: C OMPARISON OF ROBUST ACCURACY SUBJECT TO A MINIMUM OVERALL ACCURACY

Original: Here, we produce more results related to Table 24.
Revised: Here, we produce more results related to Table 21.

Original: Speciﬁcally, we ﬁrst tune the hyperparameters of all the methods to ensure that the overall accuracy of all methods reaches a given threshold and then compare their robustness.
Revised: Speciﬁcally, we ﬁrst tune the hyperparameters of all the methods to ensure that the overall accuracy of all methods reaches a given threshold and then compare their robustness.

Original: If P indicates the hyperparameters, then we ﬁnd max P
Revised: If P indicates the hyperparameters, then we ﬁnd max P

Original: A robust ( P ) such that A ( P ) ≥ a for some given a .
Revised: A robust ( P ) such that A ( P ) ≥ a for some given a .

Original: We present the results of CIFAR10 for a = 0 .
Revised: We present the results of CIFAR10 for a = 0 .

Original: 81 and FMNIST
Revised: 81 and FMNIST

Original: for a = 0 . 83 in Table 24 for different attacks.
Revised: for a = 0 . 83 in Table 21 for different attacks.

Original: For CIFAR10, we ﬁnd that R OGET ( a φ = PGD) is the best performer in terms of robust accuracy and R OGET ( a φ = AdvGAN) is the best performer in terms of overall accuracy (except for MIFGSM attack).
Revised: For CIFAR10, we ﬁnd that R OGET ( a φ = PGD) is the best performer in terms of robust accuracy and R OGET ( a φ = AdvGAN) is the best performer in terms of overall accuracy (except for MIFGSM attack).

Original: Moreover, R OGET ( a φ = AdvGAN) is the second-best performer in terms of robust accuracy.
Revised: Moreover, R OGET ( a φ = AdvGAN) is the second-best performer in terms of robust accuracy.

Original: For FMNIST, R OGET ( a φ = AdvGAN) achievesthe highest robust accuracy A robust (except for PGD attack).
Revised: For FMNIST, R OGET ( a φ = AdvGAN) achieves highest robust accuracy A robust (except for PGD attack)

Original: [Table]
Revised: [Table]

Original: P ERFORMANCE VARIATION WITH | S LATENT |
Revised: P ERFORMANCE VARIATION WITH | S LATENT |

Original: Here, we train both the variants of R OGET using b = 0 .
Revised: Here, we train both the variants of R OGET using b = 0 .

Original: 1 | D Tr | and evaluate using different number of instances | S latent | perturbed during test.
Revised: 1 | D Tr | and evaluate using different number of instances | S latent | perturbed during test.

Original: We already reported the results for CIFAR10 in the main.
Revised: We already reported the results for CIFAR10 in the main.

Original: In
Revised: In

Original: Figure 25, we report the results for FMNIST, which show that R OGET ( a φ = AdvGAN) and R OGET ( a φ = PGD) outperform the baselines at the smaller values of | S latent | .
Revised: Figure 22, we report the results for FMNIST, which show that R OGET ( a φ = AdvGAN) and R OGET ( a φ = PGD) outperform the baselines at the smaller values of | S latent | .

Original: For larger value of | S latent | , our methods are only being outperformed by the PGD-AT.
Revised: For larger value of | S latent | , our methods are only being outperformed by the PGD-AT.

Original: [Figure]
Revised: [Figure]

Original: In the experiments, i.e. , in Figures 5 and 25, we kept the value of ρ same across different values of | S latent | , set by worst case hyperparameter selection with b = 0 .
Revised: In the experiments, i.e. , in Figures 5 and 22, we kept the value of ρ same across different values of | S latent | , set by worst case hyperparameter selection with b = 0 .

Original: | D tr | We observed that our method performed better for smaller values of | S latent | .
Revised: | D tr | We observed that our method performed better for smaller values of | S latent | .

Original: Next, we adjust ρ for different | S latent | with b = | S latent | | D test | | D tr | , i.e. , we provide a little information about the proportion of instances that are going to be attacked.
Revised: Next, we adjust ρ for different | S latent | with b = | S latent | | D test | | D tr | , i.e. , we provide a little information about the proportion of instances that are going to be attacked.

Original: Figure 26 summarizes the results which show that R OGET ( a φ = AdvGAN) outperforms the baselines for a wide range of the size of attacked test instances.
Revised: Figure 23 summarizes the results which show that R OGET ( a φ = AdvGAN) outperforms the baselines for a wide range of the size of attacked test instances.

Original: [Figure]
Revised: [Figure]

Original: Here, we performed experiments where we plugged TRADES loss in the proposed algorithm.
Revised: Here, we performed experiments where we plugged TRADES loss in the proposed algorithm.

Original: Results are as follows for CIFAR10 for PGD and Square attack.
Revised: Results are as follows for CIFAR10 for PGD and Square attack.

Original: [Table]
Revised: [Table]

Original: We observe that plugging TRADES in our algorithm improves the performance of TRADES in terms of the overall accuracy.
Revised: We observe that plugging TRADES in our algorithm improves the performance of TRADES in terms of the overall accuracy.

Original: H. E XPERIMENTS WITH LOSS BASED ATTACK
Revised: H. E XPERIMENTS WITH LOSS BASED ATTACK

Original: Here, we performed the experiments where the adversary chooses instances based on the predicted accuracy.
Revised: Here, we performed the experiments where the adversary chooses instances based on the predicted accuracy.

Original: The following table summarizes the results for PGD and Square Attacks which show that our methods outperform the existing method in terms of the overall accuracy as well as robust accuracy.
Revised: The following table summarizes the results for PGD and Square Attacks which show that our methods outperform the existing method in terms of the overall accuracy as well as robust accuracy.

Original: [Table]
Revised: [Table]

Revised: [Table]