To answer your question about the baseline, we experimented with two new sample audio generated by the same (Karplus-Strong) algorithm and tested against Alexa. The result is shown in Table.1. The musical audio does not fool Alexa. Thank you again for your constructive feedback! Currently, we are also trying to activate the wake-word using our adversary.

We thank the reviewers for their detailed and constructive feedback. It is not clear. . . It feels that there is a skip between Sections 2 and 3 . . . RF-softmax method and its analysis) and smoothing the transition from section 2 to section 3. We have motivated the The paper perhaps lacks a discussion on approaches . . . As for [V embu et al., 2009], given ways to generate uniform samples for the set of classes, The notation is not very clear, especially in the appendix. . .

We thank all reviewers for their positive reception of our paper and for their constructive feedback. On dual norms and prior work. Thank you for pointing us to the relevant prior work of Demontis et al. and Xu et al. which we apparently missed. We will discuss these connections between our work and the prior work of Demontis et al. and Xu et al. in the Nevertheless, as MNIST is the only vision dataset for which we've been able to train models to high levels of MNIST is clearly not solved from an adversarial robustness perspective. We think this is an interesting open problem for the community to consider.

Lasso, and it is of great theoretical interest. Figure 3 suggested by reviewer. We remark on some confusion as follows: 1.

Reconstruction results (best seen when zoomed in). Figure 1: (a) Input on the left and reconstructed image on the right for CelebA HQ 256. We would like to thank all the reviewers for positive and constructive feedback. Reconstruction: The reconstructed images in NV AE are indistinguishable from the training images (see Figure 1(a)). GANs are perhaps less prone to this, as they may drop modes without being penalized. Is the data conditioned on all zz z's: 's in their log space, and we limit Training curves: Figure 1 in the supplementary material demonstrates training stability with spectral regularization.

We thank all reviewers for their encouraging and constructive feedback. The scores determine the order in which nodes are fused. The reviewer is correct that each Transformer layer in Fig.3 only outputs a feature embedding that is In Eq.2, the actions are produced by the final layer in Fig.3 is an illustration of The yellow part in Fig.4 is the same as Fig.3. We will add more detailed explanations about GNN's limitations on tracking global node dependencies. Y es, GO can be trained in an on-line scenario similar to Decima.

See also response to R2 above.

We use theoretical tools with a strong mathematical foundation and apply them in a novel way.

Reviewers 1, 2 and 4. Our main algorithmic innovation is in step 1 (robust subspace estimation), and our contribution Q: Could the adversary first look at *all* batches and then pick the corruptions? We have revised Assumption 2 accordingly. Q: more *direct* approach ... A: [31] defines "meta-learning" as Eq. We will survey those approaches in Section 3. Our approach is tailored for such settings with k null d . We will address all the comments and typos in the final version of the paper.