Machine learning algorithms are vulnerable to poisoning attacks: An adversary can inject malicious points in the training dataset to influence the learning process and degrade the algorithm's performance. Optimal poisoning attacks have already been proposed to evaluate worst-case scenarios, modelling attacks as a bi-level optimization problem. Solving these problems is computationally demanding and has limited applicability for some models such as deep networks. In this paper we introduce a novel generative model to craft systematic poisoning attacks against machine learning classifiers generating adversarial training examples, i.e. samples that look like genuine data points but that degrade the classifier's accuracy when used for training. We propose a Generative Adversarial Net with three components: generator, discriminator, and the target classifier. This approach allows us to model naturally the detectability constrains that can be expected in realistic attacks and to identify the regions of the underlying data distribution that can be more vulnerable to data poisoning. Our experimental evaluation shows the effectiveness of our attack to compromise deep networks, bypassing different type of existing defences against data poisoning.
This paper proposed a method pGAN based on Generative Adversarial Networks to generate poisoning examples in order to degrade the performance of classifiers when trained on the poisoned training data. The authors evaluated pGAN on both synthetic datasets and commonly used MNIST and Fashion MNIST datasets in machine learning.
The paper is self-contained and easy to read. My main concern is on the experiment results. The detailed questions are as follows:
Q1: Has the authors tried more complicated datasets such as CIFAR-10 to evaluate the pGAN method? It would make the paper more convincing to add results on more complex datasets.
Q2: Can the authors structure the experimental results with different sections? Currently it is just a single section which is difficult to read. 
Q3: The authors noticed that “But, as we decrease the value of α, the distribution of red points shifts towards the region where both green and blue distributions overlap”. This observation is interesting as it finds that the poisoned input tends to lie on the overlap of two classes. But this can easily lead to a defense method: remove those training examples that are close to the other class. This defense mechanism can be used together with other sanitization approaches. So I would like to see how would pGAN perform in this case?
Q4: The authors mentioned “Comparison with existing poisoning attacks in the research literature is challenging: Optimal poisoning attacks as in Munoz-Gonzalez et al. (2017) are computationally very expensive for the size of the networks and datasets used in our experiments in Fig. 2.”. 
However, I can not agree because you can simply generate poisoned data and train the neural networks on the poisoned data regardless of the underlying approach that is targeted in generating the poisoned data. This would be an effective baseline to compare. (Correct me if I am wrong here.)
I will change my score if the authors can address my concerns here.
================================================================
Thanks for the rebuttal. I am more convinced now.