text: In this paper, the authors propose a novel method for generating adversarial examples when the model is a black-box and we only have access to its decisions (and a positive example).   It iteratively takes steps along the decision boundary while trying to minimize the distance to the original positive example. Pros:- Novel method that works under much stricter and more realistic assumptions. - Fairly thorough evaluation. - The paper is clearly written. Cons:- Need a fair number of calls to generate a small perturbation.   Would like to see more analysis of this. - Attack works for making something outside the boundary (not X),  but is less clear how to generate image to meet a specific classification (X).   3.2 attempts this slightly by using an image in the class,  but is less clear for something like FaceID. - Unclear how often the images generated look reasonable.   Do different random initializations given different quality examples?