From: NIPS.cc/2018/Workshop/IRASL
title: Acceptance Decision
decision: Reject

From: NIPS.cc/2018/Workshop/IRASL/Paper40/AnonReviewer2
title: Reject; unclear
review: 
The paper was about a method to adversarial examples.
It was not immediately obvious how this method works, e.g. where the derivatives come from (what is the objective function?)  The paper is very unclear.


rating: 2: Marginally below acceptance threshold
confidence: 2: The reviewer is fairly confident that the evaluation is correct

From: NIPS.cc/2018/Workshop/IRASL/Paper40/AnonReviewer3
title: no proof that the adversarial attack results in speech that is intelligible to a human
review: This paper proposes to generate adversarial attacks on ASR by modifying the waveform in a manner that moves the MFCC toward a zero-vector.  

The problem with this idea is that the MFCC is a pretty good measure of speech intelligibility.  If you null out the MFCC, you'll generally make the speech unintelligible as well.  The paper tries to fight that effect with a fairly simple auditory model: distortion above 5kHz or below 200Hz is considered inaudible, and distortion in the foothills of a large spectral peak is considered inaudible.  No evidence is given that the results are still intelligible to a human.  In particular, distortion below 200Hz is also inaudible to most microphones and loudspeakers; distortion above 5kHz is often more audible to humans than it is to microphones.  The idea of masking distortion under loud signal components is a good one, but far more effective measures of perceptual masking are used routinely in the automatic speech coding literature since the mid-1980s.

The grammar is only just barely intelligible.  
rating: 2: Marginally below acceptance threshold
confidence: 2: The reviewer is fairly confident that the evaluation is correct

From: NIPS.cc/2018/Workshop/IRASL/Paper40/AnonReviewer1
title: Transferable and Configurable Audio Adversarial Attack from Low-Level Features
review: Summary:
 - The paper describes an untargeted adversarial attack on ASR systems, which is based on an MFCC feature representation

Positive:
 - the authors have tested their approach with multiple ASR systems
 - the proposed attack appears to be effective

Negative:
 - The two core ideas of working with MFCCs and using psychoacoustic masking have been published and described very broadly in other recent works, cf. 
 https://arxiv.org/pdf/1801.00554.pdf
 http://web.stanford.edu/class/cs224s/reports/Dan_Iter.pdf  and 
 https://arxiv.org/abs/1808.05665  
 where both the approach and the psychoacoustic model are more highly optimized.
 - The evaluation is only done for untargeted attacks.
 - The paper is not well written. There are many errors and typos throughout.
- it is not 100% clear if the CTC attack and the proposed approach are comparable. While the noise level maximum has been set to 28dB for both, it is not certain that indeed both reach this level. If only the MFCC attack goes up to the maximum level, the CTC attack is disadvantaged unfairly in the evaluation.

rating: 1: Strong rejection
confidence: 2: The reviewer is fairly confident that the evaluation is correct