Original: We attack on this set for all the methods and show the results in Table
Revised: We attack on this set for all the methods and show the results in Table

Original: [Table]
Revised: [Table]

Original: We observe that our method makes a good trade-off between accuracy and robustness.
Revised: We observe that our method makes a good trade-off between accuracy and robustness.

Original: Although RFGSM-AT is best in terms of overall accuracy, its robustness is very poor.
Revised: Although RFGSM-AT is best in terms of overall accuracy, its robustness is very poor.

Original: [Table]
Revised: [Table]

Original: H. W ORST - CASE HYPERPARAMETER SETTING FOR FMNIST
Revised: H. W ORST - CASE HYPERPARAMETER SETTING FOR FMNIST

Original: We present the results of worst-case hyperparameter selection for FMNIST in Table 18.
Revised: We present the results of worst-case hyperparameter selection for FMNIST in Table 18.

Original: Here, we achieve the best overall accuracy A for three attacks and second-best overall accuracy for the rest.
Revised: Here, we achieve the best overall accuracy A for three attacks and second-best overall accuracy for the rest.

Original: [Table]
Revised: [Table]

Original: H. E XPERIMENTS ON CIFAR 
Revised: H. E XPERIMENTS ON CIFAR

Original: Here, we present results on CIFAR-100 dataset.
Revised: Here, we present results on CIFAR-100 dataset.

Original: Here, the model is Resnet-9.
Revised: Here, the model is Resnet-9.

Original: We conducted experiments on CIFAR100 for only the top-5 baselines which we found competitive on other datasets.

Original: In default hyperparameter setting, we use ρ = 0 .
Revised: In default hyperparameter setting, we use ρ = 0 .

Original: 5 for R OGET ( a φ = PGD) and ρ = 2 . 

Revised: 5 for R OGET ( a φ = PGD) and ρ = 2 .

Original: for R OGET ( a φ = AdvGAN) .
Revised: for R OGET ( a φ = AdvGAN) .

Original: For the baselines, we choose the same default hyperparameters as in CIFAR10.
Revised: For the baselines, we choose the same default hyperparameters as in CIFAR10.

Original: The results can be seen in Table 19.
Revised: The results can be seen in Table 19.

Original: We also report the results of worst-case hyperparameter setting in Table 20.
Revised: We also report the results of worst-case hyperparameter setting in Table 20.

Original: We observe that our method outperforms all the baselines in terms of clean, robust (except on PGD attack), and overall accuracies.
Revised: We observe that our method outperforms all the baselines in terms of clean, robust (except on PGD attack)

Original: [Table]
Revised: [Table]

Revised: and overall accuracies

Revised: [Table]

Original: [Table]
Revised: [Table]

Original:  C OMPARISON OF ROBUST ACCURACY SUBJECT TO A MINIMUM OVERALL ACCURACY
Revised: H. C OMPARISON OF ROBUST ACCURACY SUBJECT TO A MINIMUM OVERALL ACCURACY

Original: Here, we produce more results related to Table 21.
Revised: Here, we produce more results related to Table 21.

Original: Speciﬁcally, we ﬁrst tune the hyperparameters of all the methods to ensure that the overall accuracy of all methods reaches a given threshold and then compare their robustness.
Revised: Speciﬁcally, we ﬁrst tune the hyperparameters of all the methods to ensure that the overall accuracy of all methods reaches a given threshold and then compare their robustness.

Original: If P indicates the hyperparameters, then we ﬁnd max P
Revised: If P indicates the hyperparameters, then we ﬁnd max P

Original: A robust ( P ) such that A ( P ) ≥ a for some given a .
Revised: A robust ( P ) such that A ( P ) ≥ a for some given a .

Original: We present the results of CIFAR10 for a = 0 .
Revised: We present the results of CIFAR10 for a = 0 .

Original: 81 and FMNIST
Revised: 81 and FMNIST

Original: for a = 0 . 83 in Table 21 for different attacks.
Revised: for a = 0 . 83 in Table 21 for different attacks.

Original: For CIFAR10, we ﬁnd that R OGET ( a φ = PGD) is the best performer in terms of robust accuracy and R OGET ( a φ = AdvGAN) is the best performer in terms of overall accuracy (except for MIFGSM attack).
Revised: For CIFAR10, we ﬁnd that R OGET ( a φ = PGD) is the best performer in terms of robust accuracy and R OGET ( a φ = AdvGAN) is the best performer in terms of overall accuracy (except for MIFGSM attack).

Original: Moreover, R OGET ( a φ = AdvGAN) is the second-best performer in terms of robust accuracy.
Revised: Moreover, R OGET ( a φ = AdvGAN) is the second-best performer in terms of robust accuracy.

Original: For FMNIST, R OGET ( a φ = AdvGAN) achieves  highest robust accuracy A robust (except for PGD attack)
Revised: For FMNIST, R OGET ( a φ = AdvGAN) achieves the highest robust accuracy A robust (except for PGD attack).

Original: [Table]
Revised: [Table]

Original: P ERFORMANCE VARIATION WITH | S LATENT |
Revised: P ERFORMANCE VARIATION WITH | S LATENT |

Original: Here, we train both the variants of R OGET using b = 0 .
Revised: Here, we train both the variants of R OGET using b = 0 .

Original: 1 | D Tr | and evaluate using different number of instances | S latent | perturbed during test.
Revised: 1 | D Tr | and evaluate using different number of instances | S latent | perturbed during test.

Original: We already reported the results for CIFAR10 in the main.
Revised: We already reported the results for CIFAR10 in the main.

Original: In
Revised: In

Original: Figure 22, we report the results for FMNIST, which show that R OGET ( a φ = AdvGAN) and R OGET ( a φ = PGD) outperform the baselines at the smaller values of | S latent | .
Revised: Figure 22, we report the results for FMNIST, which show that R OGET ( a φ = AdvGAN) and R OGET ( a φ = PGD) outperform the baselines at the smaller values of | S latent | .

Original: For larger value of | S latent | , our methods are only being outperformed by the PGD-AT.
Revised: For larger value of | S latent | , our methods are only being outperformed by the PGD-AT.

Original: [Figure]
Revised: [Figure]

Original: In the experiments, i.e. , in Figures 5 and 22, we kept the value of ρ same across different values of | S latent | , set by worst case hyperparameter selection with b = 0 .
Revised: In the experiments, i.e. , in Figures 5 and 22, we kept the value of ρ same across different values of | S latent | , set by worst case hyperparameter selection with b = 0 .

Original: | D tr | We observed that our method performed better for smaller values of | S latent | .
Revised: | D tr | We observed that our method performed better for smaller values of | S latent | .

Original: Next, we adjust ρ for different | S latent | with b = | S latent | | D test | | D tr | , i.e. , we provide a little information about the proportion of instances that are going to be attacked.
Revised: Next, we adjust ρ for different | S latent | with b = | S latent | | D test | | D tr | , i.e. , we provide a little information about the proportion of instances that are going to be attacked.

Original: Figure 23 summarizes the results which show that R OGET ( a φ = AdvGAN) outperforms the baselines for a wide range of the size of attacked test instances.
Revised: Figure 23 summarizes the results which show that R OGET ( a φ = AdvGAN) outperforms the baselines for a wide range of the size of attacked test instances.

Original: [Figure]
Revised: [Figure]

Original: Here, we performed experiments where we plugged TRADES loss in the proposed algorithm.
Revised: Here, we performed experiments where we plugged TRADES loss in the proposed algorithm.

Original: Results are as follows for CIFAR10 for PGD and Square attack.
Revised: Results are as follows for CIFAR10 for PGD and Square attack.

Original: [Table]
Revised: [Table]

Original: We observe that plugging TRADES in our algorithm improves the performance of TRADES in terms of the overall accuracy.
Revised: We observe that plugging TRADES in our algorithm improves the performance of TRADES in terms of the overall accuracy.

Original: H. E XPERIMENTS WITH LOSS BASED ATTACK
Revised: H. E XPERIMENTS WITH LOSS BASED ATTACK

Original: Here, we performed the experiments where the adversary chooses instances based on the predicted accuracy.
Revised: Here, we performed the experiments where the adversary chooses instances based on the predicted accuracy.

Original: The following table summarizes the results for PGD and Square Attacks which show that our methods outperform the existing method in terms of the overall accuracy as well as robust accuracy.
Revised: The following table summarizes the results for PGD and Square Attacks which show that our methods outperform the existing method in terms of the overall accuracy as well as robust accuracy.

Original: [Table] [Table]
Revised: [Table] [Table]