text: Quality: Although the research problem is an interesting direction  the quality of the work is not of a high standard.  My main conservation is that the idea of perturbation in semantic latent space has not been described in an explicit way.  How different it will be compared to a perturbation in an input space?  Clarity: The use of the term "adversarial" is not quite clear in the context  as in many of those example classification problems the perturbation completely changes the class label (e.g. from "church" to "tower" or vice-versa) Originality: The generation of adversarial examples in black-box classifiers has been looked in GAN literature as well and gradient based perturbations are studied too.  What is the main benefit of the proposed mechanism compared to the existing ones? Significance: The research problem is indeed a significant one  as it is very important to understand the robustness of the modern machine learning methods by exposing them to adversarial scenarios where they might fail. pros: (a) An interesting problem to evaluate the robustness of black-box classifier systems (b) generating adversarial examples for image classification as well as text analysis. (c) exploiting the recent developments in GAN literature to build the framework forge generating adversarial examples. cons:(a) The proposed search algorithm in the semantic latent space could be computationally intensive.  any remedy for this problem? (b) Searching in the latent space z could be strongly dependent on the matching inverter $I_\gamma(.)$.  any comment on this? (c) The application of the search algorithm in case of imbalanced classes could be something that require further investigation.