has'practical impact in a number of real-world applications, ' specifically'where security and privacy are important. '

We thank the reviewers for their thoughtful and constructive reviews. 'theoretically and experimentally grounded,' and'extremely well-written,' that it'could easily be used in practice,' and Below we respond to the major comments; we will fix the minor ones in the final version. Experiments for CIFAR-100 are in progress and we will add those and the results of Table I to the final paper. The MLP and CNN are a bit old models [...] We used MLP and CNNs since they were used in studies that we We will add the'mixeup training' results into the revised paper. We performed experiments similar to arXiv:1902.02476