1. Concerns about baselines (R1): For clarifying, the general idea of adversarially robust pre-training was first

We truly appreciate all reviewers (R1, R2, R3)' valuable comments, which will greatly help improve our final paper. The final version will be carefully polished up. This work's main goal is to improve this idea by leveraging contrastive learning, for the first time. Also, we already followed [1] to employ TRADE [23] in our supervised fine-tuning. We will make this clear in paper.