Design of reliable systems must guarantee stability against input perturbations. In machine learning, such guarantee entails preventing overfitting and ensuring robustness of models against corruption of input data. In order to maximize stability, we analyze and develop a computationally efficient implementation of Jacobian regularization that increases classification margins of neural networks. The stabilizing effect of the Jacobian regularizer leads to significant improvements in robustness, as measured against both random and adversarial input perturbations, without severely degrading generalization properties on clean data.
The main contribution of this paper is that it proposed an estimator of Jacobian regularization term for neural networks to reduce the computational cost reduced by orders of magnitude, and the estimator is mathematically proved unbiased. In details, the time consumed for the application of Jacobian regularizer and the unbiasedness of the proposed estimator are proved mathematically. Then the author experimentally demonstrated that the proposed regularization term retains all the practical benefits of the exact method but with a low computation cost. Quantitative experiments are provided to illustrate that the proposed Jacobian regularizer does not adversely affect the model, can be used simultaneously with other regularizers and effectively improve the model's robustness against random and adversarial input perturbations.
In general, this paper was well organized and it is also great that an efficient approximation of the Jacobian regularizer can be derived. However, the paper was written in a quite misleading or over-claimed way. The major comments are as follows:
(1)	It is not new to use Jacobian regularizer for improving the robustness learning. Such idea has been elaborated in [1] (though it was cited in the paper). The main contribution is, the paper proposed an efficient approximated way to the exact Jacobian term. All the benefits of robust learning are rooted in the Jacobian regularization. 
(2)	In light of point (1), the title of this paper was first quite misleading. Robust learning with Jacobian was not proposed by the paper, so the title makes no sense.  Instead, efficient approximation should be emphasized.
(3)	Most of the advantages shown in the quantitative experiments are the benefits of Jacobian regularization! The authors should focus on the approximating algorithm rather than the merits of Jacobian regularization which has been discussed in [1]. In another word, it is better to add more comparison based on running time so as to illustrate the significant performance between the proposed regularizer and the exact one. 
(4)	In section 3, it may be interesting to see more comparison results if two regularizers were combined, e.g., (L2+Dropout, L2+Jacobianor Dropout+Jacobian). 
[1] Varga, Dániel, Adrián Csiszárik, and Zsolt Zombori. "Gradient regularization improves accuracy of discriminative models." arXiv preprint arXiv:1712.09936 (2017).
===============
I have read the authors' response. I would have to say that, though I enjoy reading the paper and the other parts of this paper are very good,  the paper's contribution/novelty may be limited because Jacobian regularization has been earlier thoroughly discussed in [1] and even another recent  paper published in ECCV 2018. 
I am afraid that I  would firmly keep my original rating.