AD V-BNN: IMPROVED ADVERSARIAL DEFENSE THROUGH ROBUST BAYESIAN NEURAL NETWORK
We present a new algorithm to train a robust neural network against adversarial attacks. Our algorithm is motivated by the following two ideas. First, although recent work has demonstrated that fusing randomness can improve the robustness of neural networks (Liu et al., 2017), we noticed that adding noise blindly to all the layers is not the optimal way to incorporate randomness. Instead, we model randomness under the framework of Bayesian Neural Network (BNN) to formally learn the posterior distribution of models in a scalable way. Second, we formulate the mini-max problem in BNN to learn the best model distribution under adversarial attacks, leading to an adversarial-trained Bayesian neural network. Experiment results demonstrate that the proposed algorithm achieves state-of-the-art performance under strong attacks. On CIFAR-10 with VGG network, our model leads to 14% accuracy improvement compared with adversarial training (Madry et al., 2017) and random self-ensemble (Liu et al., 2017) under PGD attack with 0.035 distortion, and the gap becomes even larger on a subset of ImageNet 1 .
After feedback: I would like to thank the authors for careful revision of the paper and answering and addressing most of my concerns. From the initial submission my main concern was clarity and now the paper looks much more clearer. 
I believe this is a strong paper and it represents an interesting contribution for the community.
Still things to fix:
a) a dataset used in 4.2 is not stated
b) missing articles, for example, p.5 ".In practice, however, we need a weaker regularization for A small dataset or A large model"
c) upper case at the beginning of a sentence after question: p.8 "Is our Adv-BNN model susceptible to transfer attack? we answer" - "we" -> "We"
====================================================================================
The paper proposes a Bayesian neural network with adversarial training as an approach for defence against adversarial attacks. 
Main pro:
It is an interesting and reasonable idea for defence against adversarial attacks to combine adversarial training and randomness in a NN (bringing randomness into a new level in the form of a BNN), which is shown to outperform both adversarial training and random NN alone.
Main con:
Clarity. The paper does not crucially lack clarity but some claims, general organisation of the paper and style of quite a few sentences can be largely improved.
In general, the paper is sound,  the main idea appears to be novel and the paper addresses the very important and relevant problem in deep learning such as defence against adversarial attacks. Writing and general presentation can be improved especially regarding Bayesian neural networks, where some clarity issues almost become quality issues. Style of some sentences can be tuned to more formal.
In details:
1. The organisation of Section 1.1 can be improved: a general concept "Attack" and specific example "PGD Attack" are on the same level of representation, while it seems more logical that "PGD Attack" should be a subsection of "Attack". And while there is a paragraph "Attack" there is no paragraph "Defence" but rather only specific examples
2. The claim “we can either sample w ∼ p(w|x, y) efficiently without knowing the closed-form formula through the method known as Stochastic Gradient Langevin Dynamics (SGLD) (Welling & Teh, 2011)” sounds like SGLD is the only sampling method for BNN, which is not true, see, e.g., Hamiltonian Monte Carlo (Neal’s PhD thesis 1994). It is better to be formulated as "through, for example, the method ..."
3. Issues regarding eq. (7):
   a) Why there is an expectation over (x, y)? There should be the joint probability of all (x, y) in the evidence.
   b) Could the authors add more details about why it is the ELBO given that it is unconventional with adversarial examples added?
   c)  It seems that it should be log p(y | x^{adv}, \omega) rather than p(x^{adv}, y | \omega). 
   d) If the authors assume noise component, i.e., y = f(x; \omega) + \epsilon, then they do not need to have a compulsory Softmax layer in their network, which is important, for example, for regression models. Then the claim “our Adv-BNN method trains an arbitrary Bayesian neural network” would be more justified
4. It would make the paper more self-contained if the Bayes by Backprop algorithm would be described in more details (space can be taken from the BNN introduction). And it seems to be a typo that it is Bayes by Backprop rather than Bayes by Prop
5. There are missing citations in the text:
    a) no models from NIPS 2017 Adversarial Attack and Defence competition (Kurakin et al. 2018) are mentioned
    b) citation to justify the claim “C&W attack and PGD attack (mentioned below) have been recognized as
two state-of-the-art white-box attacks for image classification task”
    c) “we can approximate the true posterior p(w|x, y) by a parametric distribution q_θ(w), where the unknown parameter θ is estimated by minimizing KL(q_θ(w) || p(w|x, y)) over θ” - there are a variety of works in approximate inference in BNN, it would be better to cite some of them here
    d) citation to justify the claim "although in these cases the KL-divergence of prior and posterior is hard to compute and practically we replace it with the Monte-Carlo estimator, which has higher variance, resulting in slower convergence rate.”
6. The goal and result interpretation of the correlation experiment is not very clear
7. From the presentation of Figure 4 it is unclear that this is a distribution of standard deviations of approximated posterior.
8. “To sum up, our Adv-BNN method trains an arbitrary Bayesian neural network with the adversarial examples of the same model” – unclear which same model is meant
9. "Among them, there are two lines of work showing effective results on medium-sized convolutional networks (e.g., CIFAR-10)" - from this sentence it looks like CIFAR-10 is a network rather than a dataset
10. In "Notations" y introduction is missing
11. It is better to use other symbol for perturbation rather than \boldsymbol\delta since \delta is already used for the Dirac delta function
12. “via tuning the coefficient c in the composite loss function” – the coefficient c is never introduced
Minor:
1. There are a few missing articles, for example, in Notations, “In this paper, we focus on the attack under THE norm constraint…”
2. Kurakin et al. (2017) is described in the past tense whereas Carlini & Wagner (2017a) is described in the present tense
3. Inner brackets in eq. (2) are bigger than outer brackets
4. In eq. (11) $\delta$ is not bold
5. In eq. (12) it seems that the second and third terms should have “-” rather than “+”
6. Footnote in page 6 seems to be incorrectly labelled as 1 instead of 2