reviews: 
Comments: This paper proposes a method, clipped NGM, to improve the performance of adversarial attack. Intuition, theory, and numerical experiments are provided.
Strengths: The paper is self-contained, with all intuition, theory, and numerical results included.
Weaknesses: [1] A literature review is not sufficient. Checking through the reference list, the most recent literature is a paper from ICLR2021. The authors are encouraged to search for papers published in recent three years to highlight the difficulty of the problem and the novelty of their proposed method.

In addition, some literature is missing:

Croce, Francesco, et al. "Robustbench: a standardized adversarial robustness benchmark." arXiv preprint arXiv:2010.09670 (2020).

Croce, Francesco, and Matthias Hein. "Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks." International conference on machine learning. PMLR, 2020.

Please compare the proposed method with the attack in the above literature. Robustbench is an important leaderboard evaluating the robustness of different training methods in adversarial training.

[2] When describing the results in Figure 3, it is mentioned that "the generated noise in each image is human-imperceptible". However, I think the noise in the proposed method is more obvious than the one from PGD, and such a difference leads to the difference in the attack success rates. Figure 3 is not convincing enough.

The authors may visualize the data under different attacks in their latent space to see whether any attack is easier to detect than others.

[3] The authors need to use different data sets in the experiments, e.g., CIFAR-10, CIFAR-100, ImageNet. The current experiments are not sufficient to demonstrate the improvements of the proposed method. The authors may also consider other neural network architectures, e.g., WideResNet models or ViT.

[4] My understanding of the proposed attack method is that it combines attack and some existing optimization methods. In addition, from how the proof is presented in the appendix, the proof follows some routine steps in proving optimization convergence, and the theoretical contribution is also limited. The authors may need to highlight the novelty and emphasize the difficulty or potential challenge when crafting their proposed method. 

[5] The writing needs improvement. For example, the math notations can be improved. An attack algorithm aims to find a perturbation in x, and (9) and (10) are using x. However, in other formulas, the notation w is used. The notation w is often used for model parameters rather than the data x, confusing readers.

Another suggestion is to emphasize the purpose of each paragraph at the beginning of the paragraphs. When reading this paper, sometimes I have to read the whole paragraph, understand the details, and eventually get to know the purpose of the paragraph. Although the paragraphs still contain all the information, reading this paper is tiring.
Recommendation: 5: marginally below the acceptance threshold
Reviewer confidence: 3: You are fairly confident in your assessment. It is possible that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work. Math/other details were not carefully checked.
Soundness/correctness: 2 fair
Clarity: 2 fair