Weakness: However, I'm not very convinced with experimental results and I a bit doubt that this method would work in general and is useful in any sense. 1. The authors propose a new classification network, but I a bit doubt that its classification error is universally as good as the standard softmax network. It is a bit dangerous to build a new model for better detecting out-of-distribution samples, while losing its classification accuracy. Could the authors report the classification accuracy of the proposed classifier on ImageNet data? Some theoretical justifications, if possible, would be great for the issue. 2. The detection procedure (i.e., measuring the norm of the predicted embedding) is not intuitive and I am not convinced why it is expected to work. Could the authors provide more detailed explanations about it? 3. The baselines to compare are not enough, e.g., compare the proposed method with LID [1] which is one of the state-of-the-art detection methods for detecting adversarial samples. [1] Ma, X., Li, B., Wang, Y., Erfani, S.M., Wijewickrema, S., Houle, M.E., Schoenebeck, G., Song, D. and Bailey, J., Characterizing adversarial subspaces using local intrinsic dimensionality. In ICLR, 2018 4. Similar to Section 4.3, it is better to report AUROC and detection error when the authors evaluate their methods for detecting adversarial samples.
1. The authors propose a new classification network, but I a bit doubt that its classification error is universally as good as the standard softmax network. It is a bit dangerous to build a new model for better detecting out-of-distribution samples, while losing its classification accuracy. Could the authors report the classification accuracy of the proposed classifier on ImageNet data? Some theoretical justifications, if possible, would be great for the issue.