We train a feed forward neural network with increased robustness against adversarial attacks compared to conventional training approaches. This is achieved using a novel pre-trained building block based on a mean field description of a Boltzmann machine. On the MNIST dataset the method achieves strong adversarial resistance without data augmentation or adversarial training. We show that the increased adversarial resistance is correlated with the generative performance of the underlying Boltzmann machine.
The recent work of Schott et al (which the authors compare results to) proposed the use of Bayes rule inversion as a more robust mechanism for classification under different types of adversarial attacks. The probabilities are approximated with variational autoencoders. During training the inference network is used, but during testing optimization based inference is carried out to compute loglikelihoods.
This paper focuses on the second part, with a different model. Specifically, it proposes a specific Boltzmann machine to be used as a first layer of neural networks for MNIST classification. This Boltzmann machine is pre-trained in two-stages using mean field inference of the binary latent variables and gradient estimation of the parameters.  This pre-trained model is then incorporated into the neural net for MNIST classification.  The existence of couplings J_h among the hidden units means that we have to carry out mean field inference over several iterations to compute the output activations of the model. This is basically analogous to the optimization-based inference proposed by Schott et al. (As a detail, this optimization can be expressed as computation over several layers of a neural net.)
The authors compare to the work of Schott for one type of attack. It would be nice to see more detailed experiments as done in Schott.
Questions:
1- Why not use a single Boltzmann machine with 128 fully connected latent variables? Could you add this experiment please.
2- Why is a two-stage pre-training (Figure 2) process needed? Why not just a single stage?
3- Is the key that you used only 679 patches containing 98% of occurrences in the dataset as the first stage? What if we vary this percentage? How sensitive are the results? Such experiments could be useful to understand better why your method appears to work well.
4- Could you please add the found J_h's to the appendix. This architecture reminds me of the good old MRFs for image denoising. Could it be that what we are seeing is the attack being denoised?
I am puzzled and looking forward to answers to the above questions. I don't yet understand what is the thing that makes this approach appear to work, or why you were able to drop the Bayes inference inversion altogether as done by Schott. 
Thanks in advance. I will re-adjust the review rating following your reply.