text: This paper presents a method to cope with adversarial examples in classification tasks, leveraging a generative model of the inputs. Given an accurate generative model of the input, this approach first projects the input onto the manifold learned by the generative model (the idea being that inputs on this manifold reflect the non-adversarial input distribution). This projected input is then used to produce the classification probabilities. The authors test their method on various adversarially constructed inputs (with varying degrees of noise). Questions/Comments: - I am interested in unpacking the improvement of Defense-GAN over the MagNet auto-encoder based method. Is the MagNet auto-encoder suffering lower accuracy because the projection of an adversarial image is based on an encoding function that is learned only on true data? If the decoder from the MagNet approach were treated purely as a generative model, and the same optimization-based projection approach (proposed in this work) was followed, would the results be comparable? - Is there anything special about the GAN approach, versus other generative approaches? - In the black-box vs. white-box scenarios, can the attacker know the GAN parameters? Is that what is meant by the "defense network" (in experiments bullet 2)? - How computationally expensive is this approach take compared to MagNet or other adversarial approaches? Quality: The method appears to be technically correct. Clarity: This paper clearly written; both method and experiments are presented well. Originality: I am not familiar enough with adversarial learning to assess the novelty of this approach. Significance: I believe the main contribution of this method is the optimization-based approach to project onto a generative model's manifold. I think this kernel has the potential to be explored further (e.g. computational speed-up, projection metrics).