In this task, you are given a paper review. Based on the review, your job is to identify language and generate "en" if the review is in English or generate "es" if the review is in Spanish. Note that URLs in the text have been replaced with [Link].

El artículo tiene dos contribuciones principales: una discusión sobre la utilidad de los controles SCADA sobre dispositivos móviles, una descripción de algunas de las aplicaciones concreta que implementan esta función en celulares o tablets.  Hay varios errores de escritura a lo largo del artículo. Por ejemplo se utilizan separadores al final de frase _, pero no en forma consistente. La primera y última oración del abstract parecen mal redactadas. En los párrafos finales de la introducción las listas no son claramente explicadas.  Si bien es relevante para la conferencia hacer una revisión de aplicaciones SCADA para móviles, no se define un mecanismo de búsqueda, ni un criterio para compararlas. ¿Cuáles son sus diferencias? ¿Cuál es adecuada en cada caso?  Se sugiere incluir una tabla comparativa de sus prestaciones, y más importante, definir criterios de comparación para poder aportar nuevos datos al lector. Las conclusiones retoman la introducción pero no responden qué aplicaciones convendría usar para el contexto de industria minera.
es

This work combines a LDA-type topic model with a RNN and models this by having an additive effect on the predictive distribution via the topic parameters. A variational auto-encoder is used to infer the topic distribution for a given piece of text and the RNN is trained as a RNNLM. The last hidden state of the RNNLM and the topic parameters are then concatenated to use as a feature representation.  The paper is well written and easy to understand. Using the topic as an additive effect on the vocabulary allows for easy inference but intuitively I would expect the topic to affect the dynamics too, e.g. the state of the RNN. The results on using this model as a feature extractor for IMDB are quite strong. Is the RNN fine-tuned on the labelled IMDB data? However, the results for PTB are weaker. From the original paper, an ensemble of 2 LSTMs is able to match the topicRNN score. This method of jointly modelling topics and a language model seems effective and relatively easy to implement.  Finally, the IMDB result is no longer state of the art since this result appeared in May (Miyato et al., Adversarial Training Methods for Semi-Supervised Text Classification).  Some questions: How important is the stop word modelling? What do the results look like if l_t = 0.5 for all t?  It seems surprising that the RNN was more effective than the LSTM. Was gradient clipping tried in the topicLSTM case? Do GRUs also fail to work?  It is also unfortunate that the model requires a stop-word list. Is the link in footnote 4 the one that is used in the experiments?  Does factoring out the topics in this way allow the RNN to scale better with more neurons? How reasonable does the topic distribution look for individual documents? How peaked do they tend to be? Can you show some examples of the inferred distribution? The topics look odd for IMDB with the top word of two of the topics being the same: 'campbell'. It would be interesting to compare these topics with those inferred by LDA on the same datasets.  Minor comments: Below figure 2: GHz -> GB \Gamma is not defined.
en

I reviewed the manuscript on December 5th.  Summary: The authors investigate the phenomenon of adversarial perturbations and ask whether one may build a system to independently detect an adversarial data point -- if one could detect an adversarial example, then might prevent a machine from automatically processing it. Importantly, the authors investigate whether it is possible to build an adversarial detector which is resilient to adversarial examples built against *both* the classifier and the detector. Their results suggest that training a detector in this more difficult setting still yields gains but does not entirely resolve the problem of detecting adversarial examples.  Major comments:  The authors describe a novel approach for dealing with adversarial examples from a security standpoint -- namely, build an independent system to detect the adversary so a human might intervene in those cases.   A potential confound of this approach is that an adversary might respond by constructing adversarial examples to fool *both* the original classifier and the new detector. If that were possible, then this approach is moot since an attacker could always outwit the original system. To their credit, the authors show that building a 'dynamic' detector to detect adversarial examples but also be resilient to an adversary mitigates this potential escalation (worse case from 55% to 70% detection rate). Even though the 'dynamic' detector  demonstrates positive gains, I am concerned about overall scores. Detecting adversarial examples at this rate would not be a reliable security procedure.  My second comment is about 'model transferability'. My definition of 'model transferability' is different then the one used in the paper. My definition means that one constructs an adversarial example on one network and measures how well the adversarial examples attack a second trained model -- where the second model has been trained with different initial conditions. (The author's definition of 'transferability' is based on seeing how well the detector generalizes across training methods). 'Model transferability' (per my definition) is quite important because it measures how general an adversarial example is across all models -- and not specific to a given trained model. Different methods have different levels of 'model transferability' (Kurakin et al, 2016) and I am concerned how well the detector they built would be able to detect adversarial examples across *all models* and not just the trained model in question. In other words, a good detector would be able to detect adversarial examples from any network and not just one particularly trained network. This question seems largely unaddressed in this paper but perhaps I missed some subtle point in their descriptions.  Minor comments:  If there were any points in the bottom-left of the Figure 2 left, then this would be very important to see -- perhaps move the legend to highlight if the area contains no points.  - X-axis label is wrong in Figure 2 right.  Measure the transferability of the detector?  - How is \sigma labeled on Figure 5?  - Whenever an image is constructed to be an 'adversary', has the image actually been tested to see if it is adversarial? In other words, does the adversarial image actually result in a misclassification by the original network?

en