Eq. (15) has been derived for perturbations of thetrainingdata. At this point we have a choice of how to adversarially perturb the classifier to achieve the largest effectonthenetworkoutput. Then, with similar reasoning that led to Eq.(12)wenowobtain: When we measure quantities from the neural net, we subtract the initialpredictionf0,since the NTK expression Eq.(3) does not take the initialization of the network into account. D.2 AdditionalPlots Complementing Figure 1 in the main text, we show (the first 100) NTK features in Robustness UsefulnessspacedefinedinSec.