e038453073d221a4f32d0bab94ca7cee-AuthorFeedback.pdf

We fully understand the concern about our baselines since2 we are the first to improve certified robustness of metric learning. Therefore, as Reviewer 4 suggested, we add3 experiments comparing with neural networks certification methods, including ordinary neural networks certified by4 CROWN [48] and randomized-smoothing neural networks [11]. The results are shown in Figure i. In general, computational11 cost is not an issue for ARML. To make the comparison fair, all of15 the methods are run on CPU (Xeon(R) E5-2620 v4 @16 2.10GHz).