Paper:
A DIRECT APPROACH TO ROBUST DEEP LEARNING USING ADVERSARIAL NETWORKS
Deep neural networks have been shown to perform well in many classical machine learning problems, especially in image classification tasks. However, researchers have found that neural networks can be easily fooled, and they are surprisingly sensitive to small perturbations imperceptible to humans. Carefully crafted input images (adversarial examples) can force a well-trained neural network to provide arbitrary outputs. Including adversarial examples during training is a popular defense mechanism against adversarial attacks. In this paper we propose a new defensive mechanism under the generative adversarial network (GAN) framework. We model the adversarial noise using a generative network, trained jointly with a classification discriminative network as a minimax game. We show empirically that our adversarial network approach works well against black box attacks, with performance on par with state-of-art methods such as ensemble adversarial training and adversarial training with projected gradient descent.

Review:
Summary: The paper proposes a GAN-based approach for dealing with adversarial instances, with the training of a robust discriminator that is able to identify adversaries from clean samples, and a generator that produces adversarial noise for its given input clean image in order to mislead the discriminator. In contrast to the state-of-the-art “ensemble adversarial training” approach, which relies on several pre-trained neural networks for generating adversarial examples, the authors introduce a way for dynamically generating adversarial examples on-the-fly by using a generator, which they along with their clean counterparts are then consumed for training the discriminator. 
Quality: The paper is relatively well-written, although a little sketchy, and its motivations are clear. The authors compare their proposed approach with a good of variety of strong defenses such as “ensemble adversarial training” and “PGD adversarial training”, supporting with convincing experiments their approach.
Originality: Xioa et al. (2018) used very similar technique for generating new adversarial examples (generator attack), then used for training a robust discriminator. Likewise, Lee et al. (2018) also used GANs to produce perturbations for making images misclassified. Given this, what is the main novelty of this approach comparing to the (Xioa et al., 2018) and (Lee et al., 2018)? These references should be discussed in details in the paper.
Moreover, limited comparison with different attacks: Why did not compare against targeted attacks such as T-FGS, C&W or GAN-attack?
It is really surprising that undefended network is working better (showing more robustness) than the defended network “adversarial PGD” on black-box attacks, why this is happening?
References:
- Xiao, C., Li, B., Zhu, J. Y., He, W., Liu, M., & Song, D. (2018). Generating adversarial examples with adversarial networks. arXiv preprint arXiv:1801.02610.
- Lee, H., Han, S., & Lee, J. (2017). Generative Adversarial Trainer: Defense to Adversarial Perturbations with GAN. arXiv preprint arXiv:1705.03387.