Review for NeurIPS paper: Watch out! Motion is Blurring the Vision of Your Deep Neural Networks

Weaknesses: Even though the author claims that the proposed method is able to generate adversarial images of more plausible appearance, compared with other noise-based methods, I don't think motion blur is a good choice for the adversarial attack algorithms. Motion blurs are more notable in the images and easier to detect in the input compared with the noise-based attacks. The goal for generating adversarial images is to improve the classifier's performance when encounter two images having similar high-level features or visually the same. However, the introducing of motion blur can change the global consistency among the high-level features of classifier. The author states that the proposed motion blur attacks are hard to remove by deblurring methods than normal motion blurs, which in my opinion, doesn't make any sense. Based on the results and how the motion blur is constructed in this paper, the synthesized blurs are more likely to be applied on the whole image, instead of on a specific object (Figure 2 and 5).