Paper:
CASCADE ADVERSARIAL MACHINE LEARNING REG- ULARIZED WITH A UNIFIED EMBEDDING
Injecting adversarial examples during training, known as adversarial training, can improve robustness against one-step attacks, but not for unknown iterative attacks. To address this challenge, we first show iteratively generated adversarial images easily transfer between networks trained with the same strategy. Inspired by this observation, we propose cascade adversarial training, which transfers the knowledge of the end results of adversarial training. We train a network from scratch by injecting iteratively generated adversarial images crafted from already defended networks in addition to one-step adversarial images from the network being trained. We also propose to utilize embedding space for both classification and low-level (pixel-level) similarity learning to ignore unknown pixel level perturbation. During training, we inject adversarial images without replacing their corresponding clean images and penalize the distance between the two embeddings (clean and adversarial). Experimental results show that cascade adversarial training together with our proposed low-level similarity learning efficiently enhances the robustness against iterative attacks, but at the expense of decreased robustness against one-step attacks. We show that combining those two techniques can also improve robustness under the worst case black box attack scenario.

Review:
The paper presents a novel adversarial training setup, based on distance based loss of the feature embedding.
+ novel loss
+ good experimental evaluation
+ better performance
- way too long
- structure could be improved
- pivot loss seems hacky
The distance based loss is novel, and significantly different from prior work. It seems to perform well in practice as shown in the experimental section.
The experimental section is extensive, and offers new insights into both the presented algorithm and baselines. Judging the content of the paper alone, it should be accepted.
However, the exposition needs significant improvements to warrant acceptance. First, the paper is way too long and unfocused. The recommended length is 8 pages + 1 page for citations. This paper is 12+1 pages long, plus a 5 page supplement. I'd highly recommend the authors to cut a third of their text, it would help focus the paper on the actual message: pushing their new algorithm. Try to remove any sentence or word that doesn't serve a purpose (help sell the algorithm).
The structure of the paper could also be improved. For example the cascade adversarial training is buried deep inside the experimental section. Considering that it is part of the title, I would have expected a proper exposition of the idea in the technical section (before any results are presented). While condensing the paper, consider presenting all technical material before evaluation.
Finally, the pivot "loss" seems a bit hacky. First, the pivot objective and bidirectional loss are exactly the same thing. While the bidirectional loss is a proper loss and optimized as such (by optimizing both E^adv and E), the pivot objective is no loss function, as it does not correspond to any function any optimization algorithm could minimize. I'd recommend the just remove the pivot objective, or at least not call it a loss.
In summary, the results and presented method are good, and eventually deserve publication. However the exposition needs to significantly improve for the paper to be ready for ICLR.