Task: Language Identification
Input (Spanish, English): I reviewed the manuscript as of December 7th.  Summary: The authors investigate the transferability of adversarial examples in deep networks. The authors confirm that transferability exists even in large models but demonstrate that it is difficult to manipulate the network to adversarially perturb an image into a specifically desired label. The authors additionally demonstrate real world attacks on a vision web service and explore the geometric properties of adversarial examples.  Major Comments: 1. The paper contains a list of many results and it is not clear what single message this paper provides. As mentioned in the comments, this paper is effectively 15 pages and 9 page of results in the Appendix heavily discussed throughout the main body of the paper. Although there is no strict page limit for this conference, I do feel this pushes the spirit of a conference publication. I do not rule out this paper for acceptance based on the length but I do hold it as a negative because clarity of presentation is an important quality. If this paper is ultimately accepted, I would suggest that the authors make some effort to cut down the length even further beyond the 13 pages posted elsewhere. I have marked some sections to highlight areas that may be trimmed.  2. The section of geometric understanding is similar to results of 'Adversarial Perturbations of Deep Neural Networks' in Warde-Farley and Goodfellow (2015). See Figure 1.2. I am not clear what the authors show above-and-beyond these results. If there are additional findings, the authors should emphasize them.  3. The authors expand on observations by Goodfellow et al (2014) and Szegedy et al (2013) demonstrating that large-scale models are susceptible to adversarial perturbations (see also Kurakin et al (2016)). The authors additionally demonstrate that attempting to perform adversarial manipulation to convert an image to a particular, desired label is more difficult.  4. The authors demonstrate that they can target a real-world vision API. These results are compelling but it is not clear what these results demonstrate above-and-beyond Papernot et al (2016).   As far I can understand, I think that the most interesting result from this paper not previously described in the literature is to note about the unique difficulty about performing adversarial manipulation to convert an image to a particular, desired label. The rest of the results appear to expand on other results that have already appeared in the literature and the authors need to better explain what these makes these results unique above-and-beyond previous work.  Areas to Trim the Paper: - Table 1 is not necessary. Just cite other results or write the Top-1 numbers in the text. - Condense Section 2.2.1 and cite heavily. - Figure 2 panels may be overlaid to highlight a comparison.
Output (English): en