The paper elicited a significant amount of discussion. Reviewers raised two key concerns about the paper: (1) The assumption of a specific kind of norm bound is overly limiting, and (2) The discussion of related work could be substantially improved. That said, the metareviewer and some of the reviewers appreciate the simplicity of the work, the fact that it is the first provable defense that doesn't require retraining, and the potential for future work based on the ideas here. For these reasons, we recommend acceptance. We strongly urge the authors to incorporate the feedback provided in the reviews. In particular, the authors should take particular care to clarify the increment over prior work on certified defenses and the references that the reviewers cite.