.1 Based on previous work on PAC Bayes bound al . 2017 in adversarial training be 0 1 loss w

Following(Neyshaburetal.,NeurIPS2017),we6 choose u as a zero mean spherical Gaussian perturbation with varianceσ2 in every direction, and set the variance7 of the perturbation to the weight with respect its magnitudeσ = αkwk, which makes the third term become a8 constant4 q Instead, we only stated that22 (Line 150-152) theyimplicitly flatten the weight loss landscape via different techniques (additional data, regu-23 larization, and so on), while AWP explicitly performs weight perturbations to flatten the weight loss landscape.24 AWP can improve the generalization of43 original classifier against perturbations, which will benefit the certified robustness.