text: Adversarial example is studied on one synthetic data. A neural networks classifier is trained on this synthetic data.  Average distances and norms of errorneous perturbations are computed.  It is observed that small perturbation (chosen in a right direction) is sufficient to cause misclassification.  CONS: The writing is bad and hard to follow, with typos:  for example what is a period just before section 3.1 for?  Another example is "Red lines indicate the range of needed for perfect classification", which does not make sense.  Yet another example is the period at the end of Proposition 4.1.   Another example is "One counter-intuitive property of adversarial examples is it that nearly ".  It looks as if the paper was written in a hurry, and it shows in the writing.    At the beginning of Section 3, Figure 1 is discussed.  It points out that there exists adversarial directions that are very bad.  But I don't see how it is relevant to adversarial examples.  If one was interested in studying adversarial examples, then one would have done the following.  Under the setting of Figure 1, pick a test data randomly from the distribution (and one of the classes), and find an adversarial direction I do not see how Section 3.1 fits in with other parts of the paper.  Is it related to any experiment?  Why it defining a manifold attack? Putting a "conjecture" on a paper has to be accompanied by the depth of the insight that brought the conjecture.  Having an unjustified conjecture 5.1 would poison the field of adversarial examples,  and it must be removed. This paper is a list of experiments and observations, that are not coherent and does not give much insight into the topics of "adversarial examples".  The only main messages are that on ONE synthetic dataset, random perturbation does not cause misclassification and targeted classification can cause misclassification.  And, expected loss is good while worst-case loss is bad.  This, in my opinion, is not enough to be published at a conference.