Weakness] 1. The paper contains severe writing issues such as grammatical errors, abuses of mathematical symbols, unclear sentences, etc. 2. The paper needs more literature survey, especially about the existing defense methods using the manifold assumption. 3. The paper does not have enough (either theoretical or experimental) progress to get accepted, compared to previous methods using the manifold assumption.
[Comments] 1. First of all, use some spell/grammar checker (or ask someone else to proofread) to fix basic grammatical errors. 2. Section 3 is very unclear in general. First, I cannot understand the reason why the Section is needed at all. Manifold-based defense against adversarial example is not a new approach and reviewers know well about the manifold assumption in the adversarial machine learning setting. Section 3 does not introduce anything new more than those reviewers’ understanding, and the reasonings are too crude to be called an “analysis”. Second, the writing is not cohesive enough. Each paragraph is saying some topic, however, the connections between the paragraphs are not very clear, making Section 3 more confusing. Even in a single paragraph, the logical reasonings between sentences are sometimes not provided at all. Third, some of those contents are added for no reason. For example, Figure 1 exists for no reason whereas the figure is not referred at all in the paper. The propositions mentioned in Section 3.3 are vaguely written and not used at all. By having these unnecessary parts, the writing looks to be verbose and overstating. 3. In Section 5, the defense method should be written with more formality. Based on the description given in the paper “dx = p(max)-p(secondmax)”, it is very unclear what each term means. Each probability (the authors did not even say that they are probabilities) must correspond to the output from a softmax layer, but which model provides such a softmax layer output, the target classifier, or is there another classifier prepared for it? How are the described transformations used to get the divergence value? What does the detector do with the divergence? (All of these details should be described in Section 5.) Section 6.2 mentions some thresholding strategies, how did the detector work in Section 6.1, though? When thresholding is used, what is the threshold value used and what is the rationale of the choice of the threshold value? There are so many missing details to understand the method. 4. Section 7 looks to be a conclusion for experiments. This should be moved to Section 6 and Section 7 should be an overall conclusion of the paper. 5. The suggested method is neither creative nor novel, compared to the existing methods utilizing the distance from manifolds. As pointed out, the defense based on the manifold assumption is not a new approach. [1][3][4][6](These papers are only a few representative examples. There are many other papers on this type of defense.) Moreover, the idea of using probability divergence is already proposed by previous work [1] and an effective attack for such detection already exists. [2] (Of course, this paper proposes another probability divergence, but there is no support that this method could be significantly better than the previous work.) 6. The experiment should be done more extensively. It looks like that some transformations were brought from the Raff et al. paper [5] which tested the defense against the adversary as strong as possible. Specifically, Raff et al. considered potential improvements of existing attacks to attack their work then tested the defense performance against the improved attack. However, the paper only uses vanilla implementation in the Cleverhans library (or by the original authors). The authors should have shown that the proposed method is robust against a stronger adversary because adversaries who are aware of the method will not use a simple version of the attack. (At least, those adversaries will try using the attack suggested by Raff et al.) [References]
[1] (Meng & Chen) MagNet: a Two-Pronged Defense Against Adversarial Examples
[2] (Carlini & Wagner) MagNet and “Efficient Defenses Against Adversarial Attacks” are Not Robust to Adversarial Examples
[3] (Samangouei et al.) Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Models
[4] (Jiang et al.) To Trust or Not to Trust a Classifier
[5] (Raff et al.) Barrage of Random Transforms for Adversarially Robust Defense
[6] (Dubey et al.) Defense Against Adversarial Images using Web-Scale Nearest-Neighbor Search
1. The paper contains severe writing issues such as grammatical errors, abuses of mathematical symbols, unclear sentences, etc.