We are grateful to reviewers for the constructive comments, which help to improve the quality & clarity of the paper

We are grateful to reviewers for the constructive comments, which help to improve the quality & clarity of the paper. Figure 1: Test accuracy on CIFAR100 as suggested by R1 (i.e. In summary, when ambiguous passports are forged and used ( e.g. We will include above results to the final draft. V1 V2 V3 Training - Passport layers added - Passports needed - 15-30% more training time - Passport layers added - Passports needed - 100-125% more training time - Passport layers added - Passports needed - Trigger set needed - 100-150% more training time Inferencing - Passport layers & passports needed - 10% more inferencing time - Passport layers & passport NOT needed NO extra time incurred - Passport layers & passport NOT needed NO extra time incurred V erification - NO separate verification needed - Passport layers & passports needed - Trigger set needed (black-box verification) - Passport layers & passports needed (white-box verification)Table 2: Summary of network complexity for V1, V2 and V3 schemes.