**Q1. Cost of inference steps.**
Yes. If $q=100$ samples are used, evaluating the smoothed model would be $\times 100$ slower than the base model. Our method for constructing the distribution allows us to decide the number of samples $q \geq 2$, and we arbitrarily set either $q = 64$ in most of our experiments and sometimes $q = 16$. In developmental testing, we have also found $q = 8$ to perform well (i.e. certified accuracy like Figure 5).
Nevertheless, the Reviewer raises an interesting set of additional experiments to run for $q$ selection and we will include them in our revised manuscript. Below is a sample of the certified accuracy numbers (like Figure 5 / Section 2 of Rebuttal Supplementals, there both ran with $q=64$) when we run Vision Transformer at $\lambda = 1/8, 2/8, 3/8, 4/8$ for sample complexities of $q = 4,8, 16, 32, 64, 128$. On a $N = 2000$ sample from ImageNet we obtain the following smoothed classifier accuracies:
$\lambda = 1/8$: N/A, 0.662, 0.688, 0.693, 0.695, 0.691
$\lambda = 2/8$: 0.717, 0.743, 0.749, 0.754, 0.752, 0.755
$\lambda = 3/8$: N/A, 0.760, 0.774, 0.777, 0.782, 0.778
$\lambda = 4/8$: 0.776, 0.779, 0.793, 0.790, 0.791, 0.795
Note that some values for $q = 4$ are N/A because this is an insufficient discretization granularity for specifying the corresponding probabilities at $\lambda = 1/8, 3/8$. We observe that in general, increasing the value of $q$ slightly increases the accuracy of the smoothed classifier. This may be because, heuristically, smaller values of $q$ mean that the smoothed classifier is more susceptible to the choice of initial random seed.
**Q2. Robust vs non-robust model performance.**
We were also surprised by the non-MuS performance of the different models, and we can only speculate as to the cause. One possibility is that some radii used in $L^p$ robustness training were too small to generalize to our setting. Our finding that $L^\infty (\varepsilon = 8)$ did in fact outperform the non-robust case is some preliminary evidence of this.