about real-world experiments and deep density models and then answer detailed comments and questions

We thank the reviewers for their very helpful comments and suggestions. The 100% recall but very poor precision (i.e., it always predicts a shift) is expected Marginal-KS is very bad because the attack model is very strong, i.e., it mimics the marginal distribution of Thus, marginal KS will naturally fail--highlighting the limitation of prior work for this adversarial attack. F or bootstrapping, does the model need to be fit multiple times? For Gaussian, this is fairly simple. For the detection stage, the FDR was controlled below 0.05 in all See also Table 6 and 7 in appendix.