text: The authors proposed to supplement adversarial training with an additional regularization that forces the embeddings of clean and adversarial inputs to be similar. The authors demonstrate on MNIST and CIFAR that the added regularization leads to more robustness to various kinds of attacks. The authors further propose to enhance the network with cascaded adversarial training, that is, learning against iteratively generated adversarial inputs, and showed improved performance against harder attacks. The idea proposed is fairly straight-forward. Despite being a simple approach, the experimental results are quite promising. The analysis on the gradient correlation coefficient and label leaking phenomenon provide some interesting insights. As pointed out in section 4.2, increasing the regularization coefficient leads to degenerated embeddings. Have the authors consider distance metrics that are less sensitive to the magnitude of the embeddings, for example, normalizing the inputs before sending it to the bidirectional or pivot loss, or use cosine distance etc.? Table 4 and 5 seem to suggest that cascaded adversarial learning have more negative impact on test set with one-step attacks than clean test set, which is a bit counter-intuitive. Do the authors have any insight on this? Comments: 1. The writing of the paper could be improved. For example, "Transferability analysis" in section 1 is barely understandable; 2. Arrow in Figure 3 are not quite readable; 3. The paper is over 11 pages. The authors might want to consider shrink it down the recommended length.