The checkerboard phenomenon is one of the well-known visual artifacts in the computer vision field. The origins and solutions of checkerboard artifacts in the pixel space have been studied for a long time, but their effects on the gradient space have rarely been investigated. In this paper, we revisit the checkerboard artifacts in the gradient space which turn out to be the weak point of a network architecture. We explore image-agnostic property of gradient checkerboard artifacts and propose a simple yet effective defense method by utilizing the artifacts. We introduce our defense module, dubbed Artificial Checkerboard Enhancer (ACE), which induces adversarial attacks on designated pixels. This enables the model to deflect attacks by shifting only a single pixel in the image with a remarkable defense rate. We provide extensive experiments to support the effectiveness of our work for various attack scenarios using the state-of-the-art attack methods. Furthermore, we show that ACE is even applicable to large-scale datasets including ImageNet dataset and can be easily transferred to various pretrained networks.
I have to emphasize first that this is not my area of expertise so I am going to review it as an outsider. 
The authors argue that the checkerboard phenomenon can be exploited to make neural networks robust against adversarial attacks. They propose to enhance the checkerboard pattern by first adding a layer, called Artificial Checkerboard Enhancer (ACE), and then evading the attacks by zero-padding the image. The authors’ argument is that enhancing the checkerboard phenomenon will make attacks more targeted towards certain pixels, which can be evaded by shifting the image. 
Overall, I think the paper is difficult to read and is not suitable for publication. In terms of clarity, the authors do not use precise terminology that would allow the reader to reproduce their work. They allude to vague statements. For example, they introduce two KEY terminologies that are repeatedly used throughout the paper but are not properly defined (see for instance the “definition” of “Gradient Overlap” in Appendix C). 
In addition, in terms of the experiements, it certainly does not help to say that they were “reproduced by [the authors themselves]”. What does this mean?
 
In terms of originality, I agree with the first reviewer that the defense strategy seems to be easily breakable. The authors propose that they enhance the checkerboard phenomenon so that adversarial attacks become easier to implement by targeting individual pixels (the pixels in the checkerboard artifacts). Then, they pad the image with zero pixels to shift it to the right. I don’t understand how shifting the pixels would make it harder to attack (especially when the adversary knows the system). 
It would be really appreciated if the authors elaborate on the following points to help me understand their contribution: 
- The entire discussion about ACE in Section 4.1 is ad-hoc and not well-motivated. Why would ACE enhance the checkerboard patterm? Can you please explain why it works? This is not mentioned anywhere in the paper. The experiment in Section 4.2 helps a bit but it does not answer this question. 
- What wouldn't an adversary remove the padded pixels before generating the attack? In defense strategies, it is often assumed that the adversary knows the system. Can you please explain why that is not possible in this setting? 
- 
In Figure 4, the axes are \bar i and \bar j in the main body, but they are x and y in the figure. Please use the same notation.