From Adversarial Training to Generative Adversarial Networks
In this paper, we are interested in two seemingly different concepts: 	extit{adversarial training} and 	extit{generative adversarial networks (GANs)}. Particularly, how these techniques work to improve each other. To this end, we analyze the limitation of adversarial training as a defense method, starting from questioning how well the robustness of a model can generalize. Then, we successfully improve the generalizability via data augmentation by the ``fake** images sampled from generative adversarial network. After that, we are surprised to see that the resulting robust classifier leads to a better generator, for free. We intuitively explain this interesting phenomenon and leave the theoretical analysis for future work. Motivated by these observations, we propose a system that combines generator, discriminator, and adversarial attacker together in a single network. After end-to-end training and fine tuning, our method can simultaneously improve the robustness of classifiers, measured by accuracy under strong adversarial attacks, and the quality of generators, evaluated both aesthetically and quantitatively. In terms of the classifier, we achieve better robustness than the state-of-the-art adversarial training algorithm proposed in (Madry 	extit{et al.}, 2017), while our generator achieves competitive performance compared with SN-GAN (Miyato and Koyama, 2018).
 This paper touches on the limitation of adversarial training and propose a method that combines generator, discriminator, and adversarial attacker to improve the robustness and generalization ability of the network. The paper reads well (through there are a number of typos) and the source code is publicly available on the github. Pros: - It provides insights on why adversarial training may not improve robustness on the test data set. - It demonstrates that one can improve robustness on the test data set by using GAN (to predict the real data distribution) and plugging it into adversarial training. - Potential improvements on robustness and convergence speed of GAN. Cons: - lack of theoretical analysis. - needs comparison with a number of relevant work in the literature that use GAN for adversarial training, more specifically, the following works are related to this paper: * Yang Song, Rui Shu, Nate Kushman, and Stefano Ermon. Generative adversarial examples, 2018 * Chaowei Xiao, Bo Li, Jun-Yan Zhu, Warren He, Mingyan Liu, and Dawn Song. Generating adversarial examples with adversarial networks, 2018 Other comments: - There is a contradiction between Table 1 and the text on Page 1 (the contribution section). As per table 1, the performance of the proposed approach drops to 30.25%, whereas on page 1 it is mentioned it is dropped to 36.4%. - Figure 4 needs to be elaborated. The symbols are also not introduced. - It also helps if the authors provide a pseudocode specifying all the steps they took to generate the results. - Figure 6 is hard to read and interpret. It could help if the authors show fewer images and discuss some of the differences. - There are several typos in the paper.
You are a member of the scientific community tasked with peer review. Review the following paper title and abstract.
### Title + Abstract
From Adversarial Training to Generative Adversarial Networks
In this paper, we are interested in two seemingly different concepts: 	extit{adversarial training} and 	extit{generative adversarial networks (GANs)}. Particularly, how these techniques work to improve each other. To this end, we analyze the limitation of adversarial training as a defense method, starting from questioning how well the robustness of a model can generalize. Then, we successfully improve the generalizability via data augmentation by the ``fake** images sampled from generative adversarial network. After that, we are surprised to see that the resulting robust classifier leads to a better generator, for free. We intuitively explain this interesting phenomenon and leave the theoretical analysis for future work. Motivated by these observations, we propose a system that combines generator, discriminator, and adversarial attacker together in a single network. After end-to-end training and fine tuning, our method can simultaneously improve the robustness of classifiers, measured by accuracy under strong adversarial attacks, and the quality of generators, evaluated both aesthetically and quantitatively. In terms of the classifier, we achieve better robustness than the state-of-the-art adversarial training algorithm proposed in (Madry 	extit{et al.}, 2017), while our generator achieves competitive performance compared with SN-GAN (Miyato and Koyama, 2018).
user
<think>Okay, to do a decent peer review, I should start with summarizing what the work is about. This includes novelty, contributions, clarity, and impact. I might include suggestions to issues that I find critical to the usefulness of the work. Starting with novelty, there are different types of novelty. The first aspect of novelty is scope and scale. Is the work covering a broader perspective than previous works? The second aspect is methodology. Is the proposed methodology novel compared to previous methods? Do they provide any significant advantage over previous methodologies? The third aspect is results. Are the results different compared previous work? Does this lead to any novel theories or an extension of current theories? Next is clarity, I will be reading the work in depth and analyze if any sentences can be potentially ambiguous or misleading. If any sentences are ambiguous, I will state them and give a suggestion on how to rephrase such sentence or how to make more clear to the audience. Lastly, impact is important. I will attempt to predict how such work will impact the scientific community. This might include the applications of such work and how the work might transform the way we study a certain topic. Finally, I will might only mention issues that are critical. This is to keep the review as concise and helpful as possible.</think>



 This paper touches on the limitation of adversarial training and propose a method that combines generator, discriminator, and adversarial attacker to improve the robustness and generalization ability of the network. The paper reads well (through there are a number of typos) and the source code is publicly available on the github. Pros: - It provides insights on why adversarial training may not improve robustness on the test data set. - It demonstrates that one can improve robustness on the test data set by using GAN (to predict the real data distribution) and plugging it into adversarial training. - Potential improvements on robustness and convergence speed of GAN. Cons: - lack of theoretical analysis. - needs comparison with a number of relevant work in the literature that use GAN for adversarial training, more specifically, the following works are related to this paper: * Yang Song, Rui Shu, Nate Kushman, and Stefano Ermon. Generative adversarial examples, 2018 * Chaowei Xiao, Bo Li, Jun-Yan Zhu, Warren He, Mingyan Liu, and Dawn Song. Generating adversarial examples with adversarial networks, 2018 Other comments: - There is a contradiction between Table 1 and the text on Page 1 (the contribution section). As per table 1, the performance of the proposed approach drops to 30.25%, whereas on page 1 it is mentioned it is dropped to 36.4%. - Figure 4 needs to be elaborated. The symbols are also not introduced. - It also helps if the authors provide a pseudocode specifying all the steps they took to generate the results. - Figure 6 is hard to read and interpret. It could help if the authors show fewer images and discuss some of the differences. - There are several typos in the paper.
assistant
 This paper touches on the limitation of adversarial training and propose a method that combines generator, discriminator, and adversarial attacker to improve the robustness and generalization ability of the network. The paper reads well (through there are a number of typos) and the source code is publicly available on the github. Pros: - It provides insights on why adversarial training may not improve robustness on the test data set. - It demonstrates that one can improve robustness on the test data set by using GAN (to predict the real data distribution) and plugging it into adversarial training. - Potential improvements on robustness and convergence speed of GAN. Cons: - lack of theoretical analysis. - needs comparison with a number of relevant work in the literature that use GAN for adversarial training, more specifically, the following works are related to this paper: * Yang Song, Rui Shu, Nate Kushman, and Stefano Ermon. Generative adversarial examples, 2018 * Chaowei Xiao, Bo Li, Jun-Yan Zhu, Warren He, Mingyan Liu, and Dawn Song. Generating adversarial examples with adversarial networks, 2018 Other comments: - There is a contradiction between Table 1 and the text on Page 1 (the contribution section). As per table 1, the performance of the proposed approach drops to 30.25%, whereas on page 1 it is mentioned it is dropped to 36.4%. - Figure 4 needs to be elaborated. The symbols are also not introduced. - It also helps if the authors provide a pseudocode specifying all the steps they took to generate the results. - Figure 6 is hard to read and interpret. It could help if the authors show fewer images and discuss some of the differences. - There are several typos in the paper.