We thank the reviewers for their insightful feedback. We perform two new experiments to demonstrate the strength of ReColorAdv. In addition, we evaluated all attacks with 300 iterations of PGD. However, Song et al. uses a generative model to craft adversarial examples directly Zhang et al. is more similar to our work; they apply a single affine function to all pixels in an We will incorporate a discussion of similarities and differences to these works in the revised draft. Below are adversarial examples based on suggestions from R3, which we will also include in the paper.

We thank the reviewers for their insightful feedback. We perform two new experiments to demonstrate the strength of ReColorAdv. In addition, we evaluated all attacks with 300 iterations of PGD. However, Song et al. uses a generative model to craft adversarial examples directly Zhang et al. is more similar to our work; they apply a single affine function to all pixels in an We will incorporate a discussion of similarities and differences to these works in the revised draft. Below are adversarial examples based on suggestions from R3, which we will also include in the paper.