We thank all reviewers for their positive reception of our paper and for their constructive feedback

We thank all reviewers for their positive reception of our paper and for their constructive feedback. On dual norms and prior work. Thank you for pointing us to the relevant prior work of Demontis et al. and Xu et al. which we apparently missed. We will discuss these connections between our work and the prior work of Demontis et al. and Xu et al. in the Nevertheless, as MNIST is the only vision dataset for which we've been able to train models to high levels of MNIST is clearly not solved from an adversarial robustness perspective. We think this is an interesting open problem for the community to consider.