For the past few years, Deep Neural Network (DNN) robustness has become a question of paramount importance. As a matter of fact, in sensitive settings misclassification can lead to dramatic consequences. Such misclassifications are likely to occur when facing adversarial attacks, hardware failures or limitations, and imperfect signal acquisition. To address this question, authors have proposed different approaches aiming at increasing the robustness of DNNs, such as adding regularizers or training using noisy examples. In this paper we propose a new regularizer built upon the Laplacian of similarity graphs obtained from the representation of training data at each layer of the DNN architecture. This regularizer penalizes large changes (across consecutive layers in the architecture) in the distance between examples of different classes, and as such enforces smooth variations of the class boundaries. Since it is agnostic to the type of deformations that are expected when predicting with the DNN, the proposed regularizer can be combined with existing ad-hoc methods. We provide theoretical justification for this regularizer and demonstrate its effectiveness to improve robustness of DNNs on classical supervised learning vision datasets.
To improve the robustness of neural networks under various conditions, this paper proposes a new regularizer defined on the graph of the training examples, which penalizes the large similarities between representations belonging to different classes, thus increase the stability of the transformations defined by each layer of the network.
The paper is overall well written, and the idea involving the Laplacian of the similarity graph is interesting. I have reviewed this paper before. Compared to the previous version, this paper made a good improvement in its experimental results, by adding two different robustness settings in section 4.1 and section 4.3, and also include DeepFool as a strong attack method for testing adversarial robustness.
However, my main concern about the paper is still about its significance. 
1. It is still not clear why would this regularization help robustness especially when considering adversarial examples. Example 1 seems not obvious to me why maintaining the boundary margin (rather than expanding or shrinking) is preferred. As stated in the second paragraph in section 3.4, “lower value of \sigma^\ell(s) are indicative of better separation between classes”, what is the reason of not directly penalizing this value, rather than requesting a “stability” property on this value? How is this stability related to the robustness? This would request a deeper analysis and more empirical proofs in the paper.
2. Experimental results still seem not convincing to me. On one hand, based on the reported result, I am not very convincing that the proposed method outperforms Parseval, especially when considering the inconsistent behaviour of “Proposed + Parseval”. On the other hand, for adversarial robustness, the authors should have compared to the method of adversarial training as well. Beyond that, the authors should also be careful of the gradient masking effect of the proposed method. I am not sure if there is some other obvious benchmarks should be included for the other two robustness settings.
Other comments:
1. Descriptions in the last 3 paragraphs in section 3.2 are not very clear. It always took me a while to figure it out every time I read the paper. It would be very helpful if the computation process and the discussions can be separated here, maybe with a pseudo-code for computing the regularizer. 
2. On the other hand, while the proposed regularizer can be interpreted in a perspective of the Laplacian of the similarity graph, the third part in Equation (4), that expresses the smoothness as the sum of similarities between different classes, seems more intuitive to me. Emphasizing in this interpretation may also help convey the message.