text: This paper creates adversarial images by imposing a flow field on an image such that the new spatially transformed image fools the classifier.  They minimize a total variation loss in addition to the adversarial loss to create perceptually plausible adversarial images,  this is claimed to be better than the normal L2 loss functions. Experiments were done on MNIST, CIFAR-10, and ImageNet,  which is very useful to see that the attack works with high dimensional images.  However, some numbers on ImageNet would be helpful  as the high resolution of it make it potentially different than the low-resolution MNIST and CIFAR. It is a bit concerning to see some parts of Fig. 2.  Some of Fig. 2 (especially (b)) became so dotted that it no longer seems an adversarial that a human eye cannot detect.  And model B in the appendix looks pretty much like a normal model.  It might needs some experiments, either human studies, or to test it against an adversarial detector, to ensure that the resulting adversarials are still indeed adversarials to the human eye.  Another good thing to run would be to try the 3x3 average pooling restoration mechanism in the following paper: Xin Li, Fuxin Li. Adversarial Examples Detection in Deep Networks with Convolutional Filter Statistics . ICCV 2017. to see whether this new type of adversarial example can still be restored by a 3x3 average pooling the image  (I suspect that this is harder to restore by such a simple method than the previous FGSM or OPT-type, but we need some numbers). I also don't think FGSM and OPT are this bad in Fig. 4.  Are the authors sure that if more regularization are used these 2 methods no longer fool the corresponding classifiers? I like the experiment showing the attention heat maps for different attacks.  This experiment shows that the spatial transforming attack (stAdv) changes the attention of the classifier for each target class, and is robust to adversarially trained Inception v3 unlike other attacks like FGSM and CW.  I would likely upgrade to a 7 if those concerns are addressed.