text: The paper basically propose keep using the typical data-augmentation transformations done during training also in evaluation time, to prevent adversarial attacks. In the paper they analyze only 2 random resizing and random padding, but I suppose others like random contrast, random relighting, random colorization, ... could be applicable. \n\nSome of the pros of the proposed tricks is that it doesn't require re-training existing models, although as the authors pointed out re-training for adversarial images is necessary to obtain good results. \n\n\nTypically images have different sizes , however in the Dataset are described as having 299x299x3 size, are all the test images resized before hand? How would this method work with variable size images? \n\nThe proposed defense requires increasing the size of the input images, have you analyzed the impact in performance? Also it would be good to know how robust is the method for smaller sizes. \n\nSection 4.6.2 seems to indicate that 1 pixel padding or just resizing 1 pixel is enough to get most of the benefit, please provide an analysis of how results improve as the padding or size increase. \n\nIn section 5 for the challenge authors used a lot more evaluations per image, could you provide how much extra computation is needed for that model?