text: This paper presents Defense-GAN: a GAN that used at test time to map the input generate an image (G(z)) close (in MSE(G(z), x)) to the input image (x), by applying several steps of gradient descent of this MSE.  The GAN is a WGAN trained on the train set (only to keep the generator).  The goal of the whole approach is to be robust to adversarial examples, without having to change the (downstream task) classifier, only swapping in the G(z) for the x. + The paper is easy to follow. + It seems (but I am not an expert in adversarial examples) to cite the relevant litterature (that I know of) and compare to reasonably established attacks and defenses. + Simple/directly applicable approach that seems to work experimentally,  but - A missing baseline is to take the nearest neighbour of the (perturbed) x from the training set. - Only MNIST-sized images, and MNIST-like (60k train set, 10 labels) datasets: MNIST and F-MNIST. - Between 0.043sec and 0.825 sec to reconstruct an MNIST-sized image. ? MagNet results were very often worse than no defense in Table 4,  could you comment on that? - In white-box attacks, it seems to me like L steps of gradient descent on MSE(G(z), x) should be directly extended to L steps of (at least) FGSM-based attacks, at least as a control.