The proposed approach using Bayesian neural networks for robustness to adversarial is timely and interesting. One of the reviewers proposed an outline for a much simpler proof than what is used in the paper. Other reviewers raised concerns about the fairness of the comparison between HMC and VI, arguing that VI is not necessarily more scalable. Please account for reviewer comments (including updates after the response) in performing revisions.