reviews: 
Comments: This paper proposes a input preprocessing method for defending against adversarial examples. The method works by _squeezing_ the input into the range $[0, 1]$ by first performing a simple (linear + thresholding) transformation followed by a random shift and a random scaling. Finally a sigmoid activation is used to squeeze the input to $[0, 1]$. With this simple preprocessing function, this paper reports stunning performances against strong adversarial attacks.
Strengths: This paper proposes a preprocessor that obtains very strong performance on adversarial examples while not training on adversarial examples at all. This is a very surprising result if it is able to withstand thorough empirical evaluation.
Weaknesses: 1.	Gradient Masking and Suppression: The paper has many well-known signs of gradient masking, which is a phenomenon where estimating gradients of a classifier might be error-prone. In this paper, there are two components that might be causing this: (1) the random shift and scaling, (2) sigmoid squeezing. Further, Table 1 shows that the performance of the proposed method barely decreases under the strong auto attack ($\ell_infty, \ell_1$) as well as square attacks. This typically indicates some issues with the underlying evaluation [1]. 

2.	Evaluation on Black Box Attacks: Interestingly, the paper does provide an evaluation on the black box Square attack, which is considered to be a strong black box attack. However, the evaluation is subject to concern, as the performance barely dips below the benign performance after attack. A simple test to check any problems with the evaluation would be to intentionally inject adversarial examples and check if the performance is still retained [2]. 

3.	Code for the method and evaluations: Since the authors report stunning performance increases, in light of the above concerns, it would be easier to believe the claims if well documented code would be provided for each of the evaluations. 

4.	Writing: The writing is loose and informal in some parts of the paper.
	1.	P3: Step 1: What is mean, std?
	2.	“$\delta$ is a uniform one” -> “$\delta \sim {\rm Unif}([0, 1])$", etc.
	3.	Sec 4.3: It seems that the adversarial examples are generated for one realization of the network, and tested on another. This is not standard practice. 
	4.	P5: EOT — it would be useful to mention the exact parameters over EOT is performed, and how those parameters were chosen. 
	5.	Figure 2: Please show the RGB in the first column, all rows — it is hard to understand what is going on by looking at R,G,B channels separately. Even then, what are we supposed to take away from this figure?

[1]: On Adaptive Attacks to Adversarial Example Defenses, Florian Tramer, Nicholas Carlini, Wieland Brendel, Aleksander Madry

[2]: Increasing confidence in adversarial robustness evaluations. Roland S Zimmermann, Wieland Brendel, Florian Tramer, Nicholas Carlini.
Recommendation: 3: reject, not good enough
Reviewer confidence: 4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.
Soundness/correctness: 1 poor
Clarity: 2 fair