Neural network robustness has recently been highlighted by the existence of adversarial examples. Many previous works show that the learned networks do not perform well on perturbed test data, and significantly more labeled data is required to achieve adversarially robust generalization. In this paper, we theoretically and empirically show that with just more unlabeled data, we can learn a model with better adversarially robust generalization. The key insight of our results is based on a risk decomposition theorem, in which the expected robust risk is separated into two parts: the stability part which measures the prediction stability in the presence of perturbations, and the accuracy part which evaluates the standard classification accuracy. As the stability part does not depend on any label information, we can optimize this part using unlabeled data. We further prove that for a specific Gaussian mixture problem illustrated by Schmidt et al. (2018), adversarially robust generalization can be almost as easy as the standard generalization in supervised learning if a sufficiently large amount of unlabeled data is provided. Inspired by the theoretical findings, we further show that a practical adversarial training algorithm that leverages unlabeled data can improve adversarial robust generalization on MNIST and Cifar-10.
Paper summary: This paper seeks to improve robust generalization performance with the help of unlabeled data. The authors first consider the toy model presented in Schmidt et al. and show how the labeled sample complexity in the robust setting can be lowered to match the standard setting if sufficient unlabeled data is available. They then propose a practical algorithm to improve robust test accuracy and evaluate it on the MNIST and CIFAR datasets.
Comments: The problem the paper seeks to address (bridging the generalization gap in the adversarial setting) is an important one, and the paper is clear and well-written. 
As the authors discuss, there have been three (other) independent papers that tackle the same problem (which were accepted at NeurIPS). Even though I tried to evaluate this paper keeping in mind that it was written concurrently, I think it falls short in a couple of important aspects which make it hard to recommend acceptance. In particular:
1. Unlike the other papers, the algorithm discussed in the theoretical section (which is able to reduce sample complexity by leveraging unlabeled data) is entirely different from the one used in practice on MNIST/CIFAR. It would make for a more compelling case if the algorithm used experimentally could also work on the toy model or vice versa (which is the case for Carmon et al. and Uesato et al.).
2 . The empirical evaluation is not detailed enough and there is some inconsistency in the baselines. 
- In particular, the authors report that VAT attains poor robustness (<2.5% for both 5k and 10k labeled). However, Uesato et al. also benchmark against VAT in a very similar setting of 4k labelled CIFAR data points (with the same eps=8/255) and get ~32% accuracy (cf. Figure 1 from their paper). I could not find any difference between the two baselines except for the fact that Uesato et al. implement VAT with a KL divergence penalty (as suggested in the VAT paper) instead of cross entropy (as is used in this paper). This is somewhat concerning because based on the baselines reported in Uesato et al., the improvement of the approach proposed in this paper (which comes from doing 7 steps instead of 1 to find the adversarial example) are marginal. (Additionally, in this setting the approach of Uesato et al. gets robustness of about ~45% which is significantly better than ~33% reported in this paper.) 
- Moreover, this paper evaluates on much fewer benchmarks (only MNIST/CIFAR with few labeled examples) compared to the other papers (which also study for example SVHN and the impact of using unlabeled ImageNet on CIFAR robustness). 
The overlap with concurrent work is unfortunate, and it makes it hard to evaluate this paper. However, my two main concerns are (1) inconsistency in baselines which cast some doubt on the improvements offered by the proposed approach, and (2) the fact that both the algorithm and the experimental evaluation seem to be a subset of that in concurrent work (especially Uesato et al.). Thus, I have to recommend rejection.