1. Concerns about baselines (R1): For clarifying, the general idea of adversarially robust pre-training was first