text: The paper proposes the use of a GAN to learn the distribution of image classes from an existing classifier,  that is a nice and straightforward idea.  From the point of view of forensic analysis of a classifier, it supposes a more principled strategy than a brute force attack based on the classification of a database and some conditional density estimation of some intermediate image features.  Unfortunately, the experiments are inconclusive.   Quality: The key question of the proposed scheme is the role of the auxiliary dataset.  In the EMNIST experiment, the results for the “exact same” and “partly same” situations are good,  but it seems that for the “mutually exclusive” situation the generated samples look like letters, not numbers,  and raises the question on the interpolation ability of the generator.  In the FaceScrub experiment is even more difficult to interpret the results,  basically because we do not even know the full list of person identities.  It seems that generated images contain only parts of the auxiliary images related to the most discriminative features of the given classifier.  Does this imply that the GAN models a biased probability distribution of the image class?  What is the result when the auxiliary dataset comes from a different kind of images?  Due to the difficulty of evaluating GAN results, more experiments are needed to determine the quality and significance of this work. Clarity: The paper is well structured and written,  but Sections 1-4 could be significantly shorter to leave more space to additional and more conclusive experiments.  Some typos on Appendix A should be corrected. Originality: the paper is based on a very smart and interesting idea and a straightforward use of GANs.  Significance: If additional simulations confirm the author’s claims, this work can represent a significant contribution to the forensic analysis of discriminative classifiers.