Paper:
Recently, an adversarial example becomes a serious problem to be aware of because it can fool trained neural networks easily. To prevent the issue, many researchers have proposed several defense techniques such as adversarial training, input transformation, stochastic activation pruning, etc. In this paper, we propose a novel defense technique, Pixel Redrawn (PR) method, which redraws every pixel of training images to convert them into distorted images. The motivation for our PR method is from the observation that the adversarial attacks have redrawn some pixels of the original image with the known parameters of the trained neural network. Mimicking these attacks, our PR method redraws the image without any knowledge of the trained neural network. This method can be similar to the adversarial training method but our PR method can be used to prevent future attacks. Experimental results on several benchmark datasets indicate our PR method not only relieves the over-fitting issue when we train neural networks with a large number of epochs, but it also boosts the robustness of the neural network.

Review:
This paper presents a new adversarial defense method.  I found the paper difficult to understand, but as far as I understand, the method involves randomly perturbing the pixels of images in a dataset, and retraining the classifier to correctly classify these perturbed images as well.  The perturbations are done independently per pixel by quantizing the pixel value, and then using a perceptron model to generate the full pixel value from just this quantized value.  The perceptron is trained on randomly generated data mapping quantized pixel values to full pixel values (this random generation does not use the dataset statistics at all).  They use both partially converged perceptron models as well as fully converged perceptron models. 
Pros:
	1. The defense technique does not require knowledge of the attack method
Cons:
	1. The paper is incredibly difficult to understand due to the writing.
	2. The performed experiments are insufficient to determine  whether or not their technique works because:
		a. They don't compare against any other defense techniques.  In addition to at least adversarial training, I would like to also see comparisons to feature squeezing which I would expect to have a very similar effect.
		b. They do not show the results of an attack by an adversary that is aware of their technique.  (i.e. F(PR(A(F,PR,x))))  Many alternative defense techniques will work much better if we assume the adversary does not know about the technique.
		c. Their comparison against random noise is not an apples-to-apples comparison.  Instead of perturbing uniformly within a range, they perturb according to a normal distribution.  The random noise perturbations also have a much larger L2 distance than the perturbations from their technique.  To believe that their method is actually better than training with random noise I'd like to see an apples-to-apples comparison where these values are hyperparameter tuned as they presumably did for their method.
		d. They only show results for one value of epsilon and one value of "# of colors" for their technique.  Presumably if there is a mismatch between these values then the results will be much worse (i.e. if they choose a large "# of colors"/small range per color and the attacker chooses a large epsilon).
	3. Their use of machine learning models is quite ad-hoc.  In particular they use a perceptron trained on algorithmically generated data.  And their justification for using a perceptron, instead of just using the known underlying generation algorithm is that they also use a partially converged version of the perceptron as part of their model.
	4. The authors partly deanonymize the paper through a github link
	5. The main paper is 10 pages long, and the quality of the paper does not justify the additional length.