Paper:
Audio adversarial examples, imperceptible to humans, have been constructed to attack automatic speech recognition (ASR) systems. However, the adversarial examples generated by existing approaches usually involve notable noise, especially during the periods of silence and pauses, which may lead to the detection of such attacks. This paper proposes a new approach to generate adversarial audios, which uses Iterative Proportional Clipping (IPC) to significantly limit human-perceptible noise and simultaneously exploits the temporal dependency to resist the defenses based on temporal structure. Specifically, in every iteration of optimization, we use a backpropagation model to learn the raw perturbation on the original audio waveform to construct our clipping. We then impose a constraint on the perturbation at the positions with lower sound intensity across the time domain to eliminate the perceptible noise during the silent periods or pauses. IPC preserves the temporal closeness and trend in the original audio waveform to maintain the temporal dependency. We show that the proposed approach can successfully attack the latest state-of-the-art ASR model Wav2letter+, and only requires a few minutes to generate an audio adversarial example. Experimental results also demonstrate that our approach succeeds in preserving temporal dependency and can bypass temporal dependency based defense mechanisms.

Review:
This paper introduces an adversarial attack mechanism, Iterative Proportional Clipping (IPC), based on a differentiable MFCC feature extractor. In contrast to other audio attacks, the authors claim that the perturbations are well masked and are much less audible. 
They also claim to propose the first attack mechanism that takes temporal dependency into account, at least in some intuitive sense as described in Figure 2. Simulations show that state of the art speech recognizers can be attacked using the approach and certain type of defenses, based on temporal structure, can be circumvented. 	The method relies on the idea of using ‘the proportionally clipped gradient’ as a direction estimate for original audio modification. The basic idea is quite sensible and seems to be effective as supported by computational experiments.
The dataset is LibriSpeech and the speech recognizer is based on wav2letter+ -- here the MFCC features are replaced with a differentiable version to allow gradient based adversarial attacks. The experimental section is detailed and the results illustrate the 
The fundamental shortcoming with the paper is that while the method is described in detail, there is not much effort in explaining and formalizing what aspects of the proposed method make it perceptually more appealing -- as this seems to be the one of the main motivations of the paper. I would at least expect to see at least some effort to explain the proposed  clipping technique as maintaining the phase properties of the original signal. The authors claim about perceptual properties of the method seem to be somewhat anecdotal and, while I think the method is sensible, just showing the power spectrum is not very informative. Is the proposed method better just because it does good detection of the  silent periods?
I also find the use of technical jargon somewhat ambiguous at occasions (such as the term ‘linear proportionality’)
Minor:
audios -> waveforms  (audio does not have a plural form ) 
Fig 2 ‘frequency - signal frequency’ labels -- this is probably just an estimate of the power spectrum by DFT magnitude