GENERALIZABLE ADVERSARIAL TRAINING VIA SPEC- TRAL NORMALIZATION
Deep neural networks (DNNs) have set benchmarks on a wide array of supervised learning tasks. Trained DNNs, however, often lack robustness to minor adversarial perturbations to the input, which undermines their true practicality. Recent works have increased the robustness of DNNs by fitting networks using adversarially-perturbed training samples, but the improved performance can still be far below the performance seen in non-adversarial settings. A significant portion of this gap can be attributed to the decrease in generalization performance due to adversarial training. In this work, we extend the notion of margin loss to adversarial settings and bound the generalization error for DNNs trained under several well-known gradient-based attack schemes, motivating an effective regularization scheme based on spectral normalization of the DNN's weight matrices. We also provide a computationally-efficient method for normalizing the spectral norm of convolutional layers with arbitrary stride and padding schemes in deep convolutional networks. We evaluate the power of spectral normalization extensively on combinations of datasets, network architectures, and adversarial training schemes.
The paper first provides a generalization bounds for adversarial training, showing that the error bound depends on Lipschitz constant. This motivates the use of spectral regularization (similar to Miyato et al 2018) in adversarial training. Using spectral regularization to improve robustness is not new, but it's interesting to combine spectral regularization and adversarial training. Experimental results show significant improvement over vanilla adversarial training. 
The paper is nicely written and the experimental results are quite strong and comprehensive. I really like the paper but I have two questions about the results: 
1. The numbers reported in Figure 5 do not match with the performance of adversarial training in previous paper. In PGM L_inf adversarial training/attack (column 3 of Figure 5), the prediction accuracy is roughly 50% under 0.1 infinity norm perturbation. However, previous papers (e.g., "Obfuscated Gradients Give a False Sense of Security") reported 55% accuracy under 0.031 infinity norm perturbation. I wonder why the numbers are so different. 
Maybe it's because of different scales? Previous works usually scale each pixel to [0,1] or [-1,1], maybe the authors use the [0, 255] scale? But 0.1/255 will be much smaller than 0.031. 
Another factor might be the model structure. If Alexnet has much lower accuracy, it's probably worthwhile to conduct experiments on the same structure with previous works (Madry et al and Athalye et al) to make the conclusion more clear. 
2. What's the training time of the proposed method compared with vanilla adversarial training? 
3. The idea of using SN to improve robustness has been introduced in the following paper: 
"Lipschitz-Margin Training: Scalable Certification of Perturbation Invariance for Deep Neural Networks"
(but this paper did not combine it with adv training).