Paper:
Adversarial examples are considered a serious issue for safety critical applications of AI, such as finance, autonomous vehicle control and medicinal applications. Though significant work has resulted in increased robustness of systems to these attacks, systems are still vulnerable to well-crafted attacks. To address this problem several adversarial attack detection methods have been proposed. However, system can still be vulnerable to adversarial samples that are designed to specifically evade these detection methods. One recent detection scheme that has shown good performance is based on uncertainty estimates derived from Monte-Carlo dropout ensembles. Prior Networks, a new method of estimating predictive uncertainty, have been shown to outperform Monte-Carlo dropout on a range of tasks. One of the advantages of this approach is that the behaviour of a Prior Network can be explicitly tuned to, for example, predict high uncertainty in regions where there are no training data samples. In this work Prior Networks are applied to adversarial attack detection using measures of uncertainty in a similar fashion to Monte-Carlo Dropout. Detection based on measures of uncertainty derived from DNNs and Monte-Carlo dropout ensembles are used as a baseline. Prior Networks are shown to significantly out-perform these baseline approaches over a range of adversarial attacks in both detection of whitebox and blackbox configurations. Even when the adversarial attacks are constructed with full knowledge of the detection mechanism, it is shown to be highly challenging to successfully generate an adversarial sample.

Review:
Summary:
The authors propose a new method to detect adversarial attacks (examples). This approach relies on prior networks to estimate uncertainty in model predictions. Prior-networks are then trained to identify out-of-distribution inputs, and thereby used to detect adversarial examples. The authors evaluate their methodology on CIFAR-10 in different white-box and blackbox settings.
This work addresses an important question - detecting adversarial examples. Since it may not always be possible to build models that are completely robust in their predictions, detecting adversarial examples and/or identifying points where the model is uncertain is important. However, I am not convinced by the specific methodology as well as the proposed evaluation. 
Detailed comments:
- This work is largely based on the recent work by Malinin and Gales, 2018, where prior networks are developed as a scheme to identify out-of-distribution inputs. As a result, the authors rely fundamentally on the assumption that adversarial examples lie off-the data manifold. There has been no convincing evidence for this hypothesis in the literature thus far. Adversarial examples are also likely to be on the data manifold, but form a small enough set that it doesn’t affect standard generalization. But because of the high-dimensional input space, a member of this small set is still close to every “natural” data point. 
- I do not find the specific choice of attacks the authors consider convincing. (These being the attacks studied in Smith & Gal, 2018 does not seem to be a sufficient explanation). Specifically, the authors should evaluate on stronger Linf attacks such as PGD [Madry et al., 2017]. Further, it seems that the authors consider Linf eps around 80. These values seem extremely large given that eps=32 (possibly even > 16) causes perceptible changes in the images. Did the authors look at the adversarial examples created for these large eps values?
- The authors should include evaluation on a robust DNN (for example PGD trained VGG network) in the comparison. I believe that the joint success rate for this robust model will already be comparable to the proposed approach. 
- I am not convinced by the attack that the authors provide for the setting where the detection scheme is known. This attack seems similar to the approach studied in Carlini and Wagner, 2017 (Perfect-Knowledge Attack Evaluation) which was insufficient to break the randomization defense. Why did the authors not try something along the lines of the attack in Carlini and Wagner, 2017 (Looking deeper) that actually broke the aforementioned defense? Specifically, trying to find adversarial examples that have low uncertainty as predicted by the prior networks. The uncertainty loss -- minimizing KL between p_in(\pi|x_adv) and p(\pi|x_adv, \theta) -- could be added to cross entropy loss.
- In Section 4.2, how do the authors generate black box attacks? If they are white box attacks on models trained with a different seed (as in Section 4.1) the results in 4.2 are surprising. Carlini and Wagner, 2017 found white-box attacks for randomization schemes transferrable and as per my understanding, this should be reflected in Fig 3, at least for prior work.
- I am confused by the authors comment - “Figure 3c shows that in almost 100% of cases the attack yields the target class.” The joint success rate being lower than the success rate should convey that adversarial examples couldn’t be found in many of these cases. What was the value of the epsilon that was used in these plots?
Quality, Novelty and Significance:
The paper is written well, but clarity about the evaluation procedures is lacking in the main manuscript. I am also not convinced by the rigor of the evaluation of their detection methodology. Specifically: (1) they do not consider state-of-the-art attack models such as PGD and (2) the scheme they propose for a perfect knowledge attack seems insufficient. While the paper asks an important question, I do not find the results sufficiently novel or convincing. More broadly, I find the idea of using a secondary network to detect adversarial examples somewhat tenuous as it should be fairly easy for an adversary to break this other network as well.