Paper:
DO DEEP GENERATIVE MODELS KNOW WHAT THEY DON'T KNOW?
A neural network deployed in the wild may be asked to make predictions for inputs that were drawn from a different distribution than that of the training data. A plethora of work has demonstrated that it is easy to find or synthesize inputs for which a neural network is highly confident yet wrong. Generative models are widely viewed to be robust to such mistaken confidence as modeling the density of the input features can be used to detect novel, out-of-distribution inputs. In this paper we challenge this assumption. We find that the density learned by flow-based models, VAEs, and PixelCNNs cannot distinguish images of common objects such as dogs, trucks, and horses (i.e. CIFAR-10) from those of house numbers (i.e. SVHN), assigning a higher likelihood to the latter when the model is trained on the former. Moreover, we find evidence of this phenomenon when pairing several popular image data sets: FashionMNIST vs MNIST, CelebA vs SVHN, ImageNet vs CIFAR-10 / CIFAR-100 / SVHN. To investigate this curious behavior, we focus analysis on flow-based generative models in particular since they are trained and evaluated via the exact marginal likelihood. We find such behavior persists even when we restrict the flows to constant-volume transformations. These transformations admit some theoretical analysis, and we show that the difference in likelihoods can be explained by the location and variances of the data and the model curvature. Our results caution against using the density estimates from deep generative models to identify inputs similar to the training distribution until their behavior for out-of-distribution inputs is better understood.

Review:
Pros:
- The finding that SVHN has larger likelihood than CIFAR according to networks is interesting. 
- The empirical and theoretical analyses are clear, seem thorough, and make sense.
- Section 5 can provide some insight when the model is too rigid and too log-concave (e.g. Gaussian).
Cons:
- The premises of the analyses are not very convincing, limiting the significance of the paper.
- In particular, Section 4 is a series of empirical analyses, based on one dataset pair. In 3/4 of the pairs the author tried, this phenomenon is not there. Whether the findings generalize to other situations where the phenomenon appears is uncertain. 
- It is good that Section 5 has some theoretical analysis. But I personally find it very disturbing to base it on a 2nd order approximation of a probability density function of images when modeling something as intricate as models that generate images. At least this limitation should be pointed out in the paper.
- Some parts of the paper feel long-winded and aimless.
[Quality]
See above pros and cons.
A few less important disagreement I have with the paper:
- I don't think Glow necessarily is encouraged to increase sensitivity to perturbations. The bijection needs to map training images to a high-density region of the Gaussian, and that aspect would make the model think twice before making the volume term too large.
- Figure 6(a) clearly suggests that the data mean for SVHN and CIFAR are very different, instead of similar.
[Clarity]
In general, the paper is clear and easy to understand given enough reading time, but feels at times long-winded.
Section 2 background takes too much space.
Section 3 too much redundancy -- it just explains that SVHN has a higher likelihood when trained on CIFAR, and a few variations of the same experiment.
Section 4 seems to lack a high-level idea of what it want to prove -- the hypothesis around the volume term is dismissed shortly after, and it ultimately proves that we do not know what is the reason behind the high SVHN likelihood, making it look like a distracting side-experiment.
A few editorial issues:
- On page 4 footnote 2, as far as I know the paper did not define BPD.
- There are two lines of text between Fig. 4 and Fig. 5, which is confusing.
[Originality]
I am not an expert in this specific field (analyzing generative models), but I believe this analysis is novel.
However, there are papers empirically analyzing novelty detection using generative model -- should analyze or at least cite:
    Vít Škvára et al. Are generative deep models for novelty detection truly better? 
    ^ at first glance, their AUROC is never under 0.5, indicating that this phenomenon did not appear in their experiments although a lot of inlier-novelty pairs are tried.
A part of the paper's contribution (section 5 conclusion) seem to overlap with others' work. The section concludes that if the second dataset has small variances, it will get higher likelihood. But this is too similar to the cited findings on page 6 (models assign high likelihood to constant images).
[Significance] 
The paper has a very interesting finding; pointing out and in-depth analysis of negative results should benefit the community greatly.
However, only 1 dataset pair is experimented -- there should be more to ensure the findings generalize, since Sections 3 and 4 rely completely on empirical analysis. According to the conclusions of the paper, such dataset pairs should be easy to find -- just find a dataset that "lies within" another. Did you try e.g. CIFAR-100 train and CIFAR-10 test?
Section 5 is based on a 2nd order expansion on the $log p(x)$ given by a deep network -- I shouldn't be the judge of this, but from a realistic perspective this does not mean much.