text: This paper presents a reparametrization of the perturbation applied to features in adversarial examples based attacks.  It tests this attack variation on against Inception-family classifiers on ImageNet.  It shows some experimental robustness to JPEG encoding defense. Specifically about the method: Instead of perturbating a feature x_i by delta_i, as in other attacks, with delta_i in range [-Delta_i, Delta_i], they propose to perturbate x_i^*, which is recentered in the domain of x_i through a heuristic ((x_i ± Delta_i + domain boundary that would be clipped)/2), and have a similar heuristic for computing a Delta_i^*.  Instead of perturbating x_i^* directly by delta_i, they compute the perturbed x by x_i^* + Delta_i^* * g(r_i),  so they follow the gradient of loss to misclassify w.r.t. r (instead of delta).  +/-: + The presentation of the method is clear. + ImageNet is a good dataset to benchmark on. - (!) The (ensemble) white-box attack is effective  but the results are not compared to anything else, e.g. it could be compared to (vanilla) FGSM nor C&W. - The other attack demonstrated is actually a grey-box attack,  as 4 out of the 5 classifiers are known, they are attacking the 5th,  but in particular all the 5 classifiers are Inception-family models. - The experimental section is a bit sloppy at times (e.g. enumerating more than what is actually done, starting at 3.1.1.). - The results on their JPEG approximation scheme seem too explorative (early in their development) to be properly compared. I think that the paper need some more work, in particular to make more convincing experiments that the benefit lies in CIA (baselines comparison), and that it really is robust across these defenses shown in the paper.