Robustness of convolutional neural networks has recently been highlighted by the adversarial examples, i.e., inputs added with well-designed perturbations which are imperceptible to humans but can cause the network to give incorrect outputs. Recent research suggests that the noises in adversarial examples break the textural structure, which eventually leads to wrong predictions by convolutional neural networks. To help a convolutional neural network make predictions relying less on textural information, we propose defective convolutional layers which contain defective neurons whose activations are set to be a constant function. As the defective neurons contain no information and are far different from the standard neurons in its spatial neighborhood, the textural features cannot be accurately extracted and the model has to seek for other features for classification, such as the shape. We first show that predictions made by the defective CNN are less dependent on textural information, but more on shape information, and further find that adversarial examples generated by the defective CNN appear to have semantic shapes. Experimental results demonstrate the defective CNN has higher defense ability than the standard CNN against various types of attack. In particular, it achieves state-of-the-art performance against transfer-based attacks without applying any adversarial training.
The paper deals with robustness against adversarial attacks. It proposes to blank out large parts of the early convolution layers in a CNN, in an attempt to shift the focus from "texture" to "shape" features. This does seem to improve robustness against adversarial examples, with only a small decrease in general classification performance. The explanation for this, on the other hand, is not really convincing.
The idea is simple: adversarial noise introduces high-frequency texture patterns, so destroy those by blanking out a large portion of the neurons in a layer. Quite obviously, this can have an influence - when blanking out 90% of the pixels (as suggested in the paper), the effective sampling resolution goes down by a factor of 3 in each axis, and high-frequency patterns are a lot less likely to be picked up. It does, however, remain unclear why this approach is particularly useful, or why it even works at all. On the one hand, an easier way to surely get rid of those patterns is simply to blur the images accordingly before feeding them to the network. That baseline is missing. On the other hand it is quite an outrageous claim that one can throw away 90% of the responses in the early conv layers with hardly any performance loss. I don't doubt the experiments results, but if one discovers something like that, it needs to be explained. The network has  a lot lessless capacity, effectively loses a factor 3 in resolution, but performance seemingly stays almost the same!
This brings me to another point. It is never really defined what is meant by "texture" respectively "shape". By reverse-engineering from the paper text I gather that "shape" is simply texture at a significantly lower resolution. But then how does destroying "texture" affect objects with significantly lower size/scale in the image?
A few technical questions remain unclear. First, the adversarial noise in the paper looks a lot stronger than normal. It is easily visible, and in that sense not "adversarial". In fact the paper openly states that they "even fool humans". So since the labels are human-annotated, these are in fact not adversarial examples of class A, but examples of a different class wrongly labeled as class A...
Another question is how much "texture" is lost, since the paper finds it important to use a different random mask for each filter in a layer. So does that really suppress so much texture? Almost all pixels will be seen by some non-defective filters, so it would seem that the hi-res information is implicitly still there. To really suppress texture it would seem more effective to always use the same mask, but that apparently does not work. Why?
What completely confused me was which networks were actually used to generate the adversarial examples. Are these adversarial against the standard CNN or against the defective one? If defective convolutions indeed become popular, then an attacker would obviously know about that and also use a defective network to generate his adversarial examples. 
One thing I did not understand is the incoherent mixture of datasets. The first experiment with the reshuffled tiles is done on ImageNet. But then the actual experiments regarding robustness against attacks are done only with Cifar-10. Why suddenly switch? And then, many of the visual examples are from TinyImageNet. Why switch again? And on that account, since apparently all of them were processed, is the behaviour consistent across datasets?
A note aside, I am not sure it is a good idea to treat additive Gaussian noise in the same way as adversarial patterns. Some level of noise that is at least approximately Gaussian is present in almost all images. So it is actually a good thing if a network learns the magnitude of that noise, so as to separate it from the signal, i.e., the brightness variations that are informative and not Gaussian noise. In that view it is a good thing, not a weakness, if adding noise of the wrong magnitude misleads the network (although, ideally, it should of course flag the image as being out-of-distribution).
In summary, I find the results interesting - in particular also the one on tiled and reshuffled images. But I am at this point not convinced by the explanations. If one can indeed throw away 90% of all responses in the low layers then that would be a rather big thing that needs an explanation. Unless the task is easy enough to be solved with 3x lower resolution - but in that case I would expect that simply reducing the resolution would also destroy the adversarial pattern. I am on the fence, but  in its current state the paper leaves too many open questions.