1: The writing could be further improved, e.g., “via being matched to” should be “via matching to” in Abstract.
2: The “Def-adv” needs to be clarified.
3: The accuracies of the target model using different defenses against the FGSM attack are not shown in Figure 1. Hence, it is unclear the difference between the known attacks and the unknown attacks.
4: Even though authors compare their framework with an advanced defense APE-GAN, they can further compare the proposed framework with a method that is designed to defend against multiple attacks (maybe the research on defense against multiple attacks is relatively rare). The results would be more meaningful if the authors could present this comparison in their paper.
Overall the paper presents an interesting study that would be useful for defending the threat of increasing malicious perturbations.
4: Even though authors compare their framework with an advanced defense APE-GAN, they can further compare the proposed framework with a method that is designed to defend against multiple attacks (maybe the research on defense against multiple attacks is relatively rare). The results would be more meaningful if the authors could present this comparison in their paper. Overall the paper presents an interesting study that would be useful for defending the threat of increasing malicious perturbations.