Review for NeurIPS paper: The Autoencoding Variational Autoencoder

Additional Feedback: 1) Figure 1 does not aid your case that this phenomenon exists. While I am familiar with this line of research from other work and thus know that VAEs and other encoders drift, a better argument should be made to the reader, both in the introduction and in Figure 1. 2) The result that the AVAE condition makes representations more robust is empirical. This isn't a problem (empirical results are good too), but it seems almost independent to the theoretical frame and intuition of the work. I understand there are space constraints (this is a very full paper), but an analysis of why VAE vulnerabilities to adversarial attacks are mitigated by the AVAE condition would be helpful. Notably, \varepsilon perturbation type attacks are obviously not constrained to any data manifold (or, in a probabilistic sense, may move data x to rare events x \varepsilon).