b8ce47761ed7b3b6f48b583350b7f9e4-AuthorFeedback.pdf

We thank all reviewers for the encouraging feedback and detailed comments which we'll integrate into the next version. Why a noise-sensitive filter is learned by FGSM training? After running AutoAttack, we observe that it proportionally reduces the adversarial accuracy for all methods. Their exact goal is to make the loss surface smoother . R2: Line 118: How is the alpha step-size tuned for this experiments?