We present a causal view on the robustness of neural networks against input manipulations, which applies not only to traditional classification tasks but also to general measurement data. Based on this view, we design a deep causal manipulation augmented model (deep CAMA) which explicitly models the manipulations of data as a cause to the observed effect variables. We further develop data augmentation and test-time fine-tuning methods to improve deep CAMA's robustness. When compared with discriminative deep neural networks, our proposed model shows superior robustness against unseen manipulations. As a by-product, our model achieves disentangled representation which separates the representation of manipulations from those of other latent causes.
Summary:
(1) The paper makes vague and unsupported claims about causality.
   The notion of 'causal', as well as do() notation, is really hollowed out here. It is of limited significance. In Equation (3) do() disappears from one line to the next, illustrating how little it does.
(2) Lack of novelty: The paper references "Learning disentangled representations with Semi-supervised deep generative models", but fails to mention that their model is is nearly identical. 
(3) The quality is on the low side; confusing mistakes in figures, in some
 sections poor proof-reading.
Details:
(1) Exaggerated claims.
"We argue that the incapability for causal reasoning is the reason of DNN's vulnerability".  (This is stated twice in different words).
  Unfortunately, the term "causal reasoning" is used without making it precise.  The paper has a very weak relation to causality; one could replace "causal" with "translation invariant", and very little would change.  Their experiments try to learn translation invariance (appendix shows whitening invariance).
The paper makes gratuitous use of do() notation; for example, regular MNIST is reinterpreted as not being observational, but as arising from an intervention, namely do(translation=0).  But do() does not amount to much here. It reduces to mere conditioning here, as the do is always applied to a root node without parents.  This is clear in equation in 3, where do's are correctly just deleted from one line to the next; do(), and 'causal' are used mostly as a rhetorical device.
(2) The model in the paper is pretty much the same as "Learning disentangled representations with Semi-supervised deep generative models", figure 2 here corresponds to figure 4 there.  Both papers use partially supervised (or unsupervised) VAEs. There are some differences, e.g. the prior work considers a more general case and uses importance sampling.  This paper refers but fails to say how similar they are.  There should be a comparison between the difference inference methods used.
(3) The paper is sloppy in places.  
Figure 6: the dotted arrow between nodes A and Z should not be there.
It does not follow from the graphical model in Figure 5.
In Figure 12a),  the text contradicts the figure. The brown curve with fine tuning has lower accuracy than the green one without fine tuning, but the text says the opposite. 
Figure 11: there is a curve mislabelled as "Dis"
Results are mixed.  While results on vertical translation invariance and adversarial robustness seem good, the method fails to achieve horizontal translation invariance (Figure 7 b) and c)) - disappointing. But some of the translation invariance seems to be due to just using a generative model (the VAE), as it occurs without any fine-tuning.