Venue: ICML 2021 Workshop AML

Reviews:

final_score: rating: Accept
review_content: Pros:
1. The writing is good.
2. The research domain is clearly stated. The difference between Oracle-Invariant set and the Oracle-Sensitive set is clearly stated.
3. Experiments show that the proposed OA-AT is an effective algorithm to train defense model.
4. The experimental results are sufficient.
Cons:
1. Reference format is not standard.
review_title: The paper clearly defines the Oracle-Invariant set and the Oracle-Sensitive set. The proposed OA-AT method is an effective defense training algorithm.

Meta-review: A good paper in terms of writing, experiments, and techniques, as noted by the reviewer. 
Decision: Accept (Poster)