text: This paper generates adversarial examples using the fast gradient sign (FGS) and iterated fast gradient sign (IFGS) methods, but replacing the gradient computation with finite differences or another gradient approximation method.  Since finite differences is expensive in high dimensions,  the authors propose using directional derivatives based on random feature groupings or PCA.  This paper would be much stronger if it surveyed a wider variety of gradient-free optimization methods.  Notably, there's two important black-box optimization baselines that were not included:  simultaneous perturbation stochastic approximation ( https://en.wikipedia.org/wiki/Simultaneous_perturbation_stochastic_approximation), which avoids computing the gradient explicitly, and evolutionary strategies ( https://blog.openai.com/evolution-strategies/ ), a similar method that uses several random directions to estimate a better descent direction. The gradient approximation methods proposed in this paper may or may not be better than SPSA or ES.  Without a direct comparison, it's hard to know.   Thus, the main contribution of this paper is in demonstrating that gradient approximation methods are sufficient for generating good adversarial attacks and applying those attacks to Clarifai models.  That's interesting and useful to know, but is still a relatively small contribution, making this paper borderline.  I lean towards rejection,  since the paper proposes new methods without comparing to or even mentioning well-known alternatives.