Paper:
Neural network-based classifiers parallel or exceed human-level accuracy on many common tasks and are used in practical systems. Yet, neural networks are susceptible to adversarial examples, carefully perturbed inputs that cause networks to misbehave in arbitrarily chosen ways. When generated with standard methods, these examples do not consistently fool a classifier in the physical world due to a combination of viewpoint shifts, camera noise, and other natural transformations. Adversarial examples generated using standard techniques require complete control over direct input to the classifier, which is impossible in many real-world systems. We introduce the first method for constructing real-world 3D objects that consistently fool a neural network across a wide distribution of angles and viewpoints. We present a general-purpose algorithm for generating adversarial examples that are robust across any chosen distribution of transformations. We demonstrate its application in two dimensions, producing adversarial images that are robust to noise, distortion, and affine transformation. Finally, we apply the algorithm to produce arbitrary physical 3D-printed adversarial objects, demonstrating that our approach works end-to-end in the real world. Our results show that adversarial examples are a practical concern for real-world systems.

Review:
The authors present a method to enable robust generation of adversarial visual
inputs for image classification.
They develop on the theme that 'real-world' transformations typically provide a
countermeasure against adversarial attacks in the visual domain, to show that
contextualising the adversarial exemplar generation by those very
transformations can still enable effective adversarial example generation.
They adapt an existing method for deriving adversarial examples to act under a
projection space (effectively a latent-variable model) which is defined through
a transformations distribution.
They demonstrate the effectiveness of their approach in the 2D and 3D
(simulated and real) domains.
The paper is clear to follow and the objective employed appears to be sound. I
like the idea of using 3D generation, and particularly, 3D printing, as a means
of generating adversarial examples -- there is definite novelty in that
particular exploration for adversarial examples.
I did however have some concerns:
1. What precisely is the distribution of transformations used for each
   experiment? Is it a PCFG? Are the different components quantised such that
   they are discrete rvs, or are there still continuous rvs? (For example, is
   lighting discretised to particular locations or taken to be (say) a 3D
   Gaussian?) And on a related note, how were the number of sampled
   transformations chosen?
   Knowing the distribution (and the extent of it's support) can help situate
   the effectiveness of the number of samples taken to derive the adversarial
   input.
2. While choosing the distance metric in transformed space, LAB is used, but
   for the experimental results, l_2 is measured in RGB space -- showing the
   RGB distance is perhaps not all that useful given it's not actually being
   used in the objective. I would perhaps suggest showing LAB, maybe in
   addition to RGB if required.
3. Quantitative analysis: I would suggest reporting confidence intervals;
   perhaps just the 1st standard deviation over the accuracies for the true and
   'adversarial' labels -- the min and max don't help too much in understanding
   what effect the monte-carlo approximation of the objective has on things.
   Moreover, the min and max are only reported for the 2D and rendered 3D
   experiments -- it's missing for the 3D printing experiment.
4. Experiment power: While the experimental setup seems well thought out and
   structured, the sample size (i.e, the number of entities considered) seems a
   bit too small to draw any real conclusions from. There are 5 exemplar
   objects for the 3D rendering experiment and only 2 for the 3D printing one.
   While I understand that 3D printing is perhaps not all that scalable to be
   able to rattle off many models, the 3D rendering experiment surely can be
   extended to include more models? Were the turtle and baseball models chosen
   randomly, or chosen for some particular reason? Similar questions for the 5
   models in the 3D rendering experiment.
5. 3D printing experiment transformations: While the 2D and 3D rendering
   experiments explicitly state that the sampled transformations were random,
   the 3D printing one says "over a variety of viewpoints". Were these
   viewpoints chosen randomly?
Most of these concerns are potentially quirks in the exposition rather than any
issues with the experiments conducted themselves. For now, I think the
submission is good for a weak accept –- if the authors address my concerns, and/or
correct my potential misunderstanding of the issues, I'd be happy to upgrade my
review to an accept.