We thank the reviewers for their constructive feedback, and first address adding more experiments, common to

Reviewers 1, 2 and 4. Our main algorithmic innovation is in step 1 (robust subspace estimation), and our contribution Q: Could the adversary first look at *all* batches and then pick the corruptions? We have revised Assumption 2 accordingly. Q: more *direct* approach ... A: [31] defines "meta-learning" as Eq. We will survey those approaches in Section 3. Our approach is tailored for such settings with k null d . We will address all the comments and typos in the final version of the paper.