The paper found that a way to improve the robustness of gradient-based attribution maps is by smoothing the gradient attribution maps. They also propose a training regularizer (i.e. minimizing the largest eigenvalue of the Hessian w.r.t. input). All reviewers found the theory is sound and consistent with empirical results. This is a good paper and I recommend accept. I'd suggest the authors to also discuss the connection (and differentiate) between the robustness of attribution maps vs. the robustness of classifiers (e.g. would the proposed regularizer improve model robustness?).