text: Summary ======== The authors present CLEVER, an algorithm which consists in evaluating the (local) Lipschitz constant of a trained network around a data point.  This is used to compute a lower-bound on the minimal perturbation of the data point needed to fool the network. The method proposed in the paper already exists for classical function,  they only transpose it to neural networks.  Moreover, the lower bound comes from basic results in the analysis of Lipschitz continuous functions. Clarity ===== The paper is clear and well-written. Originality ========= This idea is not new:  if we search for "Lipschitz constant estimation" in google scholar, we get for example Wood, G. R., and B. P. Zhang. "Estimation of the Lipschitz constant of a function." (1996) which presents a similar algorithm (i.e., estimation of the maximum slope with reverse Weibull). Technical quality ============== The main theoretical result in the paper is the analysis of the lower-bound on \delta, the smallest perturbation to apply on a data point to fool the network.  This result is obtained almost directly by writing the bound on Lipschitz-continuous function | f(y)-f(x) | < L || y-x || where x = x_0 and y = x_0 + \delta. Comments: - Lemma 3.1: why citing Paulavicius and Zilinskas for the definition of Lipschitz continuity?  Moreover, a Lipschitz-continuous function does not need to be differentiable at all (e.g. |x| is Lipschitz with constant 1 but sharp at x=0).  Indeed, this constant can be easier obtained if the gradient exists,  but this is not a requirement. - (Flaw?) Theorem 3.2 : This theorem works for fixed target-class  since g = f_c - f_j for fixed g.  However, once g = min_j f_c - f_j, this theorem is not clear with the constant Lq.  Indeed, the function g should be  g(x) = min_{k \neq c} f_c(x) - f_k(x). Thus its Lipschitz constant is different, potentially equal to L_q = max_{k} \| L_q^k \|, where L_q^k is the Lipschitz constant of f_c-f_k.  If the theorem remains unchanged after this modification, you should clarify the proof.  Otherwise, the theorem will work with the maximum over all Lipschitz constants but the theoretical result will be weakened. - Theorem 4.1: I do not see the purpose of this result in this paper.  This should be better motivated. Numerical experiments ==================== Globally, the numerical experiments are in favor of the presented method.  The authors should also add information about the time it takes to compute the bound, the evolution of the bound in function of the number of samples and the distribution of the relative gap between the lower-bound and the best adversarial example. Moreover, the numerical experiments look to be realized in the context of targeted attack.  To show the real effectiveness of the approach, the authors should also show the effectiveness of the lower-bound in the context of non-targeted attack.