Task: Language Identification
Input (Spanish, English): This paper is a well written paper. This paper can be divided into 2 parts: 1.Adversary training on ImageNet  2.Empirical study of label leak, single/multiple step attack, transferability and importance of model capacity  For part [1], I don’t think training without clean example will not make reasonable ImageNet level model. Ian’s experiment in “Explaining and Harnessing Adversarial Examples” didn't use BatchNorm, which may be important for training large scale model. This part looks like an extension to Ian’s work with Inception-V3 model. I suggest to add an experiment of training without clean samples.  For part [2], The experiments cover most variables in adversary training, yet lack technical depth.  The depth, model capacity experiments can be explained by regularizer effect of adv training;  Label leaking is novel; In transferability experiment with FGSM, if we do careful observe on some special MNIST FGSM example, we can find augmentation effect on numbers, which makes grey part on image to make the number look more like the other numbers. Although this effect is hard to be observed with complex data such as CIFAR-10 or ImageNet, they may be related to the authors' observation "FGSM examples are most transferable".    In this part the authors raise many interesting problems or guess, but lack theoretical explanations.   Overall I think these empirical observations are useful for future work.
Output (English): en