This paper was a subject of significant discussion between the AC and reviewers. The conclusion was that the paper had sufficient merit to be accepted to NeurIPS provided the authors made changes to the paper as outlined in the post-rebuttal section of the various reviews, especially Reviewer 1. (Of course, the authors should also take into account the pre-rebuttal suggestions of the reviewers.) In particular, it is important to clarify the exact definition of robust learning and briefly discuss the consequences. For example, assigning h an adversarial loss of 1 due to x, if there exists a z in the neighborhood of x, such that h(z) \neq c(x), would mean that c does not necessarily have zero adversarial loss with respect to c, without strong margin assumptions. These may not cause problems for the results in the paper, but should definitely be discussed in the paper.