, Suggestions, Questions: 1. A theoretical discussion about following points will improve the contribution of the paper: a. Why do large margins result in higher adversarial robustness? What happens if I change the attack type? b. Benefits compared over other adversarial training methods are not clear. c. A more detailed discussion about the equilibrium state is necessary, as currently provided in Sec. 2.3. This is rather an example. 2. Experimental section: a. Need to report average over multiple runs. Results are very close together and it is hard to favor one method. b. Sec. 3.1: Since this is the toy-dataset, a discussion why the decision boundaries look as they do, would be interesting. c. Sec. 3.3: What information is in Fig. 9 middle and right? 3. Formatting and writing: a. Detailed proofreading required. e.g. on p. 3 “using cross-entropy loss and clean data for training” b. Some variables are used but not introduced. e.g. x_n1, x_n2 in Sec. 2.3. c. Figures are too small and not properly labeled in experimental section. d. References to prior work are missing as e.g. “Virtual Adversarial Training: A Regularization Method for Supervised and Semi-Supervised Learning” e. Algorithms need rework, e.g. information of Alg. 1 can be written in 2,3 lines.
Though the idea of adaptive adversarial noise magnitude is in general appealing, the paper has some weaknesses: (i) theoretical contribution is relatively minor, (ii) the paper does not present the material sufficiently clearly to the reader, and (iii) experimental evaluation is not sufficiently conclusive in favor of the paper's central hypothesis.
2. Experimental section: a. Need to report average over multiple runs. Results are very close together and it is hard to favor one method. b. Sec. 3.1: Since this is the toy-dataset, a discussion why the decision boundaries look as they do, would be interesting. c. Sec. 3.3: What information is in Fig. 9 middle and right?