We thank the reviewer for their response. We would like to clarify what we mean by "zero transferability" via an example. **We will also use this example to show how computation of the final perturbation magnitude does not depend on any independance or correlation among the frequencies.**

Consider an input feature vector of frequencies given by $f = [f_1; f_2]$. Let $E$ be an ensemble of two "disjoint" models, $F_A, F_B$. We note that by disjoint, we imply that the input feature vector to $F_A$ is $[f_1; 0]$, and the input to $F_B$ is $[0; f_2]$, i.e., for each model, we are zeroing (or masking) out the frequencies not used. This is different than the setup where the input to $F_A$ is $[f_1]$, and to $F_B$ is $[f_2]$.

**"Zero" Transferability**
Let $\delta_A = [\delta_1; 0]$ be the minimum final perturbation crafted by the adversary when attacking $F_A$ where $||\delta_A|| \leq \epsilon_A$ (second component is 0 to minimize perturbation, as it does not affect $F_A$ output). The final adversarial example is $x_A = [f_1 + \delta_1; f_2]$. This implies that the input to $F_A$ must then be $[f_1 + \delta_1; 0]$, and the input to $F_B$ is $[0; f_2]$, i.e., the adversarial example does not transfer to $F_B$ as-is.

**Adding Perturbations**
Now, if the adversary wants to simultaneously evade $F_A$ and $F_B$, the perturbation must be $\delta = [\delta_1; \delta_2]$, where the final adversarial example $x = [f_1 + \delta_1; f_2 + \delta_2]$ evades both $F_A$ and $F_B$. This final perturbation now has a magnitude of $||\delta||$ given by $||\delta||^2 = ||\delta_1||^2 + ||\delta_2||^2$ which is the sum of the individual magnitudes squared. Note that, even if $f_1$ and $f_2$ are perfectly correlated, say, identical, then $\delta_1 = \delta_2 = \delta_0$, and perturbation is given by $\delta_{correlated} = [\delta_0; \delta_0]$, the final perturbation magnitude would still be $||\delta_{correlated}||_2 = 2*||\delta_0||^2$ which again has a budget that is the sum of the individual magnitudes squared (we would like to clarify that the perturbation assumption for the proof in the Appendix is $\epsilon^2 = \sum_i \epsilon_i^2$ and not $\epsilon = \sum_i \epsilon_i$)

**WILL NOT INCLUDE:**
We acknowledge the reviewers point that if $f_1$ and $f_2$ are correlated, then $\delta_1$ may "leak" some information about $\delta_2$; in this sense of the term "transferability", D3 does not exhibit "zero transferability". We will clarify these definitions and provide examples as above in the draft.