Paper:
Generative neural models have improved dramatically recently. With this progress comes the risk that such models will be used to attack systems that rely on sensor data for authentication and anomaly detection. Many such learning systems are installed worldwide, protecting critical infrastructure or private data against malfunction and cyber attacks. We formulate the scenario of such an authentication system facing generative impersonation attacks, characterize it from a theoretical perspective and explore its practical implications. In particular, we ask fundamental theoretical questions in learning, statistics and information theory: How hard is it to detect a "fake reality"? How much data does the attacker need to collect before it can reliably generate nominally-looking artificial data? Are there optimal strategies for the attacker or the authenticator? We cast the problem as a maximin game, characterize the optimal strategy for both attacker and authenticator in the general case, and provide the optimal strategies in closed form for the case of Gaussian source distributions. Our analysis reveals the structure of the optimal attack and the relative importance of data collection for both authenticator and attacker. Based on these insights we design practical learning approaches, and show that they result in models that are more robust to various attacks on real-world data. Code will be made publicly available upon publication.

Review:
This paper proposes a new threat model for generative impersonation attacks: The attacker has access to several leaked images of a person; the authenticator knows several registration images per person and decides a person's identify by comparing some newly-sampled images from that person with corresponding registration images. The authors formulate this threat model as a minimax game and analyzed its Nash equilibrium. In the simplified case that observations are multivariate Gaussian, the authors are able to characterize the optimal strategies of the attacker and authenticator explicitly, which gives a nice intuition on how the theoretical optimum changes with respect to data dimension, number of leaked images, etc. Additionally, the authors implemented this attack (named Gan-in-the-middle attack) with an objective similar to GANs, empirically verified the theoretical results, and demonstrated the success of their approach on VoxCeleb2 and 
As far as I know, this formulation of generative impersonation attacks is novel. The threat model nicely captures the most important aspects of impersonation attacks and is relatively realistic.
The theoretical analysis is insightful. I especially like that the authors can prove no defense is possible when n <= m, which nicely matches the intuition. The results on Gaussian case not only provide intuition, but also provide motivation for the design of attacker and defender architectures in GIM attacks. 
The experiments are well-designed. The model architectures are well-motivated from Theorem 4.2. It is great to see that results of toy experiments match the theoretical analysis in Figure 1(a). The GIM attack on the Voxceleb2 images generates very realistic and reasonable portraits in Figure 2(a). The data augmentation experiment can be naturally fit into the framework of impersonation attacks and the application of their techniques in this direction is very exciting.
I only have two minor suggestions:
1. In Theorem 4.1, the symbol g_{X | Y} was introduced previously, whereas g_{X | A} was never introduced. I have to go to the appendix to understand the definition of g_{X | A}.
2. There is a minor issue in the proof of Lemma D.2 in page 16. The authors seem to miss a 1/2 factor in the second to last row in equation (D.3).