We are grateful to reviewers for the constructive comments, which help to improve the quality & clarity of the paper. Figure 1: Test accuracy on CIFAR100 as suggested by R1 (i.e. In summary, when ambiguous passports are forged and used ( e.g. We will include above results to the final draft. V1 V2 V3 Training - Passport layers added - Passports needed - 15-30% more training time - Passport layers added - Passports needed - 100-125% more training time - Passport layers added - Passports needed - Trigger set needed - 100-150% more training time Inferencing - Passport layers & passports needed - 10% more inferencing time - Passport layers & passport NOT needed NO extra time incurred - Passport layers & passport NOT needed NO extra time incurred V erification - NO separate verification needed - Passport layers & passports needed - Trigger set needed (black-box verification) - Passport layers & passports needed (white-box verification)Table 2: Summary of network complexity for V1, V2 and V3 schemes.

Let us assume Sergio is planning his next big heist and he needs his team to travel to a foreign country. Owing to the nature of his job he has decided to generate fake passports. He doesn't want to take any chances because he believes that the passport officer can discriminate between original and fake passports. He has decided to use his network of designers and experts to carry out his plans effectively. The diagram below represents Sergio's plan of action in which a fake passport is generated by using the combined skills of the professionals. If we were to generalise Sergio's plan we can say, the diagram is a generator of fake passports.