Paper:
The vulnerabilities of deep neural networks against adversarial examples have become a significant concern for deploying these models in sensitive domains. Devising a definitive defense against such attacks is proven to be challenging, and the methods relying on detecting adversarial samples are only valid when the attacker is oblivious to the detection mechanism. In this paper, we consider the adversarial detection problem under the robust optimization framework. We partition the input space into subspaces and train adversarial robust subspace detectors using asymmetrical adversarial training (AAT). The integration of the classifier and detectors presents a detection mechanism that provides a performance guarantee to the adversary it considered. We demonstrate that AAT promotes the learning of class-conditional distributions, which further gives rise to generative detection/classification approaches that are both robust and more interpretable. We provide comprehensive evaluations of the above methods, and demonstrate their competitive performances and compelling properties on adversarial detection and robust classification problems.

Review:
Review: The paper addresses the adversarial example detection problem. The framework proposed in the paper divides the input space into subspaces based on a classifier’s output and trains detectors on these subspaces to classify a natural sample (classified as that class) from an adversarial one fooling the network. The goal is to use a robust optimization approach to enable detection methods to withstand adaptive/dynamic attacks. Hence, an asymmetrical adversarial training (AAT) regime is employed which presents solving a min-max problem. AAT supports the detectors to learn class conditional distributions, motivating generative detection/classification approaches. There are three different attacking scenarios and evaluation shows that the combined attack turns out to be most effective (as it fools both the classifier and detectors) against integrated detection. The paper also demonstrates empirical improvements over state of the art detection techniques with higher L2 distortion of perturbed samples.
Pros:
- With the vulnerabilities associated with neural networks, the motivation behind building defense mechanisms against adversarial attacks has been well-justified.
- Most of the evaluation metrics look appropriate and well-defined.
- It was interesting to observe the perturbed samples produced by attacking generative classifier. While they exhibited visible features of the target class, these perturbations had to be different on a sematic level to be distinguished from the natural samples. 
Cons:
- While the idea to partition into subspaces and learn a different detection for each of them is novel, it involves training multiple detectors one by one that can be computationally expensive. The loss function for different attacking scenarios uses the outputs from all the detectors, which can also be expensive, especially when there are a lot of classes.
- To deal with extremely unbalanced data sets when training the detector, the solutions used in the paper resamples to balanced the positive and negative class data. This would mean throwing off most of the data, I would see how it affects the training.