From: ICML.cc/2021/Workshop/AML/Program_Chairs
title: Paper Decision
decision: Accept (Poster)
comment: This paper proposed an audio injection adversarial attack to make an automatic speech recognition (ASR) system to additionally output target phrases in front of its original outputs.  The authors can further address the reviewer's comments.

From: ICML.cc/2021/Workshop/AML/Paper60/Reviewer_moCW
title: A reasonable applying situation
review: This paper proposed an audio injection adversarial attack to make an automatic speech recognition (ASR) system to additionally output target phrases in front of its original outputs. It takes effect by adding perturbations at the foremost or rearmost positions of the original audio sequence. Comparing to existing methods, it can have better concealment because the victim will still get his desired instruction execution result. In addition, it uses fewer perturbations to implement attacks.
ASR)

Strengths:
1.	This method applies to a reasonable situation that there could be possible detections to check if the desired results are satisfying.

Weaknesses:
1.	The comparison result of the proposed method and existing methods lacks quantitative analysis both in attack success rate and perturbation magnitude.
2.	The authors did not clarify the ASR system they used. It is also recommended to compare different models as well as doing a transfer study.

rating: Accept
confidence: 5: The reviewer is absolutely certain that the evaluation is correct and very familiar with the relevant literature